PT-2026-22184 · Discourse · Discourse

Davidtaylorhq · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-27149

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description A SQL injection issue exists in the PM tag filtering functionality (list private messages tag) of Discourse. This allows attackers to bypass tag filter conditions, potentially leading to the disclosure of unauthorized private message metadata.

Recommendations Update to Discourse version 2025.12.2 or later. Update to Discourse version 2026.1.1 or later. Update to Discourse version 2026.2.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-DISCOURSE-2026-27149

CVE-2026-27149

GHSA-M6QF-H49W-H38W

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27149.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27149 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-27149 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27149 · Vendor Advisory
• https://twitter.com/CVEnew/status/2028683872498864222 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028684567045886290 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027252008852349151 · Twitter Post
• https://t.me/CVEtracker/45868 · Telegram Post