Discourse 2026.2.0 Latest Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*
part: a version: 2026.2.0 update: *
| Vendor | Discourse (2d3c125b-857a-5933-b846-ed7f9d5e0225) |
|---|---|
| Product | Discourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8) |
| Edition | * |
| Language | * |
| Software edition | latest |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/discourse/discourse |
purl2cpe | 2026-07-28 16:40:57.248734 |
pkg:rpm/opensuse/discourse |
purl2cpe | 2026-07-28 16:40:57.248735 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28227 |
vulnerable | 2026-06-08 07:55:15.031428 |
Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T21:27:38.926Z
Updated: 2026-03-03T14:44:26.448Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28219 |
vulnerable | 2026-06-08 07:55:15.016341 |
Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Banners
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended administrative restrictions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. There are no practical workarounds to prevent this behavior other than applying the security patch. Administrators concerned about unauthorized promotions should audit recent changes to site banners and global notices until the fix is deployed.
Published: 2026-02-26T21:25:36.635Z
Updated: 2026-03-03T15:08:17.328Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28218 |
vulnerable | 2026-06-08 07:55:15.013738 |
Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query Execution
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on each Data Explorer query that doesn't have permissions, or disable discourse-data-explorer plugin.
Published: 2026-02-26T21:23:32.354Z
Updated: 2026-03-02T21:10:27.953Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27162 |
vulnerable | 2026-06-08 07:53:21.981551 |
DIscourse doesn't prevent whispers to leak in excerpts
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian)` to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T19:58:33.819Z
Updated: 2026-03-03T01:41:54.076Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27154 |
vulnerable | 2026-06-08 07:53:21.980476 |
Discourse has XSS when editing a malicious post
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Published: 2026-02-26T21:20:25.181Z
Updated: 2026-03-02T20:57:00.349Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27153 |
vulnerable | 2026-06-08 07:53:21.980168 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27152 |
vulnerable | 2026-06-08 07:53:21.979840 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27151 |
vulnerable | 2026-06-08 07:53:21.979327 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27150 |
vulnerable | 2026-06-08 07:53:21.978815 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27149 |
vulnerable | 2026-06-08 07:53:21.978357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27021 |
vulnerable | 2026-06-08 07:53:21.835113 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26979 |
vulnerable | 2026-06-08 07:53:21.792523 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26973 |
vulnerable | 2026-06-08 07:53:21.782003 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26265 |
vulnerable | 2026-06-08 07:53:21.451126 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26207 |
vulnerable | 2026-06-08 07:53:21.406615 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26078 |
vulnerable | 2026-06-08 07:53:20.778679 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-26077 |
vulnerable | 2026-06-08 07:53:20.778284 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.