Davidtaylorhq

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.1.4 Discourse versions prior to 2026.3.1 Discourse versions prior to 2026.4.1 Discourse versions prior to 2026.5.0-latest.1 **Description** Outdated cached AI summaries can leak removed content to anonymous and unprivileged users who lack the permissions to regenerate summaries. **Recommendations** Update to version 2026.1.4. Update to version 2026.3.1. Update to version 2026.4.1. Update to version 2026.5.0-latest.1. Restrict summary generation by tightening the allowed groups on the summarization Personas.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.1.4 Discourse versions prior to 2026.3.1 Discourse versions prior to 2026.4.1 Discourse versions prior to 2026.5.0-latest.1 **Description** An authenticated user on an instance with the form templates feature enabled can read the name and structured content of form templates intended for categories they are not authorized to access. This results in the disclosure of site configuration metadata. **Recommendations** Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1 Update to version 2026.5.0-latest.1

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.1.4 Discourse versions prior to 2026.3.1 Discourse versions prior to 2026.4.1 Discourse versions prior to 2026.5.0-latest.1 **Description** A flaw in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. **Recommendations** Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1 Update to version 2026.5.0-latest.1

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 Description Discourse, an open-source discussion platform, has an issue where staged user custom fields and usernames are exposed on public invite pages without email verification. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through before 2026.1.3 Discourse versions 2026.2.0 through before 2026.2.2 Discourse versions 2026.3.0 through before 2026.3.0 Description Discourse, an open-source discussion platform, contains an authorization bypass issue. This allows unauthenticated or unauthorized users to view hidden (staff-only) tags and associated data. All Discourse instances with tagging enabled and staff-only tag groups configured are affected. Recommendations Upgrade to Discourse version 2026.1.3 or later. Upgrade to Discourse version 2026.2.2 or later. Upgrade to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description Discourse, an open-source discussion platform, had insufficient access controls on a sentiment analytics endpoint. This allowed an authenticated moderator-level user to bypass category permission boundaries and retrieve post content, topic titles, and usernames from categories they were not authorized to view. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 Description The `StaticController`'s `enter` action does not validate the `sso destination url` cookie before redirecting to it with `allow other host: true`. This cookie, normally set during legitimate DiscourseConnect Provider flows, is client-controlled and can be manipulated by attackers. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description The discourse-subscriptions plugin leaks `stripe` API keys across sites in a multisite cluster, potentially leading to the leakage of stripe-related information across sites within the same cluster. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.2.9 Description Discourse, an open-source discussion platform, had an issue where the group email settings test endpoint could be exploited to make the server initiate outbound connections to arbitrary hosts and ports. This could potentially allow probing of internal network infrastructure. The endpoint was accessible to non-staff group owners. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 Description A user may be able to purchase a lower tier subscription but grant themselves the benefits of a higher tier subscription. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description Discourse, an open-source discussion platform, had an issue where users who no longer had access to a topic could still interact with polls within that topic, including voting and changing poll status. No content was exposed, but users could modify poll states in topics they should no longer have access to. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description Discourse is an open-source discussion platform. When the `prioritize full name in ux` site setting is enabled, user and group display names are rendered without HTML escaping in assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2 Discourse versions 2026.2.0 through 2026.2.1 Discourse versions 2026.3.0 through 2026.2.9 Description Discourse, an open-source discussion platform, had a flaw where non-staff users could view read receipt information for staff-only posts. The issue did not expose post content, but revealed metadata about who read the post and when. Recommendations Upgrade to Discourse version 2026.1.3 or later. Upgrade to Discourse version 2026.2.2 or later. Upgrade to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description A flaw exists in the Category Chatables Controller 'show' action that allows moderators to bypass authorization restrictions and access information about hidden group names and user counts. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0 Description Discourse, an open-source discussion platform, allowed moderators to export CSV data for admin-restricted reports, circumventing intended report visibility restrictions. This could lead to the disclosure of sensitive operational data. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.3.0. Description Discourse, an open-source discussion platform, is affected by a flaw that allows an attacker who can create shared AI conversations to inject arbitrary HTML and JavaScript through crafted conversation titles. This injected code executes in the browser of users viewing the onebox preview, potentially leading to session hijacking or unauthorized actions. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 through 2026.2.9 Description Discourse, an open-source discussion platform, had a flaw where category group moderators could execute privileged actions on topics within private categories they were not authorized to view. This allowed unauthorized actions within restricted areas of the platform. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0. Description A flaw exists in Discourse that may allow unauthorized channel membership inference from chat user search. This issue does not require authorization to exploit. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 Description A user with valid credentials can retrieve shared draft topic titles by submitting an inline onebox request with a `category id` parameter that corresponds to the shared drafts category. Recommendations Update to Discourse version 2026.1.3 or later. Update to Discourse version 2026.2.2 or later. Update to Discourse version 2026.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 **Description** Discourse is an open-source discussion platform. An unauthenticated attacker can manipulate a legitimate Discourse authorization page to display a domain controlled by the attacker. This can be used to conduct social engineering attacks against users. **Recommendations** Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.