Discourse 2026.3.0 Latest Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*
part: a version: 2026.3.0 update: *
| Vendor | Discourse (2d3c125b-857a-5933-b846-ed7f9d5e0225) |
|---|---|
| Product | Discourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8) |
| Edition | * |
| Language | * |
| Software edition | latest |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/discourse/discourse |
purl2cpe | 2026-07-28 16:40:57.248747 |
pkg:rpm/opensuse/discourse |
purl2cpe | 2026-07-28 16:40:57.248749 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34947 |
vulnerable | 2026-06-08 07:59:13.359978 |
Discourse: Staged user custom fields are exposed on public invite pages
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-04-03T21:27:59.837Z
Updated: 2026-04-07T14:17:59.649Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33428 |
vulnerable | 2026-06-08 07:59:09.943599 |
Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
Published: 2026-03-20T23:21:20.877Z
Updated: 2026-03-25T13:42:54.320Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33427 |
vulnerable | 2026-06-08 07:59:09.943218 |
Discourse Authorization Page Displays Unvalidated Redirect Domain
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthenticated attacker can cause a legitimate Discourse authorization page to display an attacker-controlled domain, facilitating social engineering attacks against users. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
Published: 2026-03-20T23:20:03.149Z
Updated: 2026-03-23T21:41:14.354Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33426 |
vulnerable | 2026-06-08 07:59:09.942936 |
Discourse users can edit or synonymize hidden tags they can't see
LOW (3.5)
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and create synonyms for tags hidden in restricted tag groups, even if they lacked visibility into those tags. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
Published: 2026-03-20T23:14:57.484Z
Updated: 2026-03-24T15:30:29.255Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33425 |
vulnerable | 2026-06-08 07:59:09.942577 |
Discourse has inferable private group membership or existence via exclude_groups parameter
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the `exclude_groups` parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.
Published: 2026-03-20T23:12:30.489Z
Updated: 2026-03-23T16:48:49.363Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33424 |
vulnerable | 2026-06-08 07:59:09.942160 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33423 |
vulnerable | 2026-06-08 07:59:09.941722 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33422 |
vulnerable | 2026-06-08 07:59:09.941308 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33415 |
vulnerable | 2026-06-08 07:59:09.910971 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33411 |
vulnerable | 2026-06-08 07:59:09.901202 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33410 |
vulnerable | 2026-06-08 07:59:09.900816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33408 |
vulnerable | 2026-06-08 07:59:09.880377 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33395 |
vulnerable | 2026-06-08 07:59:09.846040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33394 |
vulnerable | 2026-06-08 07:59:09.845527 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33393 |
vulnerable | 2026-06-08 07:59:09.845012 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33355 |
vulnerable | 2026-06-08 07:59:09.767404 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33300 |
vulnerable | 2026-06-08 07:59:09.634359 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33291 |
vulnerable | 2026-06-08 07:59:09.625056 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33251 |
vulnerable | 2026-06-08 07:59:09.425999 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33185 |
vulnerable | 2026-06-08 07:59:09.313957 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33073 |
vulnerable | 2026-06-08 07:57:18.552519 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32951 |
vulnerable | 2026-06-08 07:57:18.373814 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32620 |
vulnerable | 2026-06-08 07:57:17.758112 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32619 |
vulnerable | 2026-06-08 07:57:17.757659 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32618 |
vulnerable | 2026-06-08 07:57:17.757099 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32615 |
vulnerable | 2026-06-08 07:57:17.752148 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32607 |
vulnerable | 2026-06-08 07:57:17.745049 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32273 |
vulnerable | 2026-06-08 07:57:17.334880 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32243 |
vulnerable | 2026-06-08 07:57:17.293999 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32143 |
vulnerable | 2026-06-08 07:57:16.730921 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32114 |
vulnerable | 2026-06-08 07:57:16.691874 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32113 |
vulnerable | 2026-06-08 07:57:16.690379 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32099 |
vulnerable | 2026-06-08 07:57:16.676630 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31869 |
vulnerable | 2026-06-08 07:57:16.020224 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-31805 |
vulnerable | 2026-06-08 07:57:15.911131 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30891 |
vulnerable | 2026-06-08 07:57:14.440923 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30889 |
vulnerable | 2026-06-08 07:57:14.440391 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-30888 |
vulnerable | 2026-06-08 07:57:14.439883 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29072 |
vulnerable | 2026-06-08 07:55:16.073733 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28282 |
vulnerable | 2026-06-08 07:55:15.139677 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27936 |
vulnerable | 2026-06-08 07:55:14.675208 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27935 |
vulnerable | 2026-06-08 07:55:14.674761 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27934 |
vulnerable | 2026-06-08 07:55:14.674073 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27740 |
vulnerable | 2026-06-08 07:53:22.924786 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27570 |
vulnerable | 2026-06-08 07:53:22.425440 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27491 |
vulnerable | 2026-06-08 07:53:22.377547 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27481 |
vulnerable | 2026-06-08 07:53:22.365909 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27454 |
vulnerable | 2026-06-08 07:53:22.333265 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-27166 |
vulnerable | 2026-06-08 07:53:21.984827 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.