Approved changes feed: RSS · Atom

cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*

part: a version: 2026.2.0 update: *

VendorDiscourse (2d3c125b-857a-5933-b846-ed7f9d5e0225)
ProductDiscourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8)
Edition*
Language*
Software editionlatest
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/discourse/discourse purl2cpe 2026-07-28 16:40:57.248734
pkg:rpm/opensuse/discourse purl2cpe 2026-07-28 16:40:57.248735

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-28227 vulnerable 2026-06-08 07:55:15.031428 Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T21:27:38.926Z
Updated: 2026-03-03T14:44:26.448Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28219 vulnerable 2026-06-08 07:55:15.016341 Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended administrative restrictions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. There are no practical workarounds to prevent this behavior other than applying the security patch. Administrators concerned about unauthorized promotions should audit recent changes to site banners and global notices until the fix is deployed.
Published: 2026-02-26T21:25:36.635Z
Updated: 2026-03-03T15:08:17.328Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-28218 vulnerable 2026-06-08 07:55:15.013738 Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on each Data Explorer query that doesn't have permissions, or disable discourse-data-explorer plugin.
Published: 2026-02-26T21:23:32.354Z
Updated: 2026-03-02T21:10:27.953Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27162 vulnerable 2026-06-08 07:53:21.981551 DIscourse doesn't prevent whispers to leak in excerpts
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian)` to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T19:58:33.819Z
Updated: 2026-03-03T01:41:54.076Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27154 vulnerable 2026-06-08 07:53:21.980476 Discourse has XSS when editing a malicious post
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T21:20:25.181Z
Updated: 2026-03-02T20:57:00.349Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27153 vulnerable 2026-06-08 07:53:21.980168 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27152 vulnerable 2026-06-08 07:53:21.979840 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27151 vulnerable 2026-06-08 07:53:21.979327 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27150 vulnerable 2026-06-08 07:53:21.978815 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27149 vulnerable 2026-06-08 07:53:21.978357 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-27021 vulnerable 2026-06-08 07:53:21.835113 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26979 vulnerable 2026-06-08 07:53:21.792523 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26973 vulnerable 2026-06-08 07:53:21.782003 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26265 vulnerable 2026-06-08 07:53:21.451126 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26207 vulnerable 2026-06-08 07:53:21.406615 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26078 vulnerable 2026-06-08 07:53:20.778679 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-26077 vulnerable 2026-06-08 07:53:20.778284 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.