PT-2026-22195 · Discourse · Data Explorer+2

Davidtaylorhq · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28218

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description Discourse is an open source discussion platform. A flaw exists in the Data Explorer plugin's access control mechanism where it fails open. This allows any authenticated user to execute SQL queries, including built-in system queries, that lack explicit group assignments. The Data Explorer plugin is affected. The vulnerable functionality allows execution of SQL queries via the plugin.

Recommendations Versions prior to 2025.12.2: Apply the update to version 2025.12.2 or later. Versions prior to 2026.1.1: Apply the update to version 2026.1.1 or later. Versions prior to 2026.2.0: Apply the update to version 2026.2.0 or later. As a temporary workaround, explicitly set group permissions on each Data Explorer query that doesn't have permissions. As a temporary workaround, disable the discourse-data-explorer plugin.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BIT-DISCOURSE-2026-28218

CVE-2026-28218

GHSA-JXRC-72MR-MFH5

Affected Products

Data Explorer

Discourse

Discourse-Data-Explorer

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28218.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28218 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-28218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28218 · Security Note
• https://twitter.com/CVEnew/status/2027466654003958197 · Twitter Post