Approved changes feed: RSS · Atom
cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:*
part: a version: 2026.3.0 update: *
| Vendor | Discourse (2d3c125b-857a-5933-b846-ed7f9d5e0225) |
|---|---|
| Product | Discourse (4347364d-ae10-5ab6-a9ec-6e7dcaf78dd8) |
| Edition | * |
| Language | * |
| Software edition | latest.1 |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/discourse/discourse |
purl2cpe | 2026-06-01 10:13:03.502080 |
pkg:rpm/opensuse/discourse |
purl2cpe | 2026-06-01 10:13:03.502082 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33415 |
vulnerable | 2026-06-08 07:59:09.910994 |
Discourse: Improper Access Control in discourse-ai Allows Unauthorized Category Content Exposure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31T17:42:15.870Z
Updated: 2026-04-03T16:21:37.890Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33300 |
vulnerable | 2026-06-08 07:59:09.634462 |
Discourse: Hidden group names and access metadata are exposed to moderators through the `category-chatables` endpoint
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31T17:42:00.882Z
Updated: 2026-04-01T18:34:16.767Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33185 |
vulnerable | 2026-06-08 07:59:09.315020 |
Discourse: Group SMTP test endpoint susceptible to SSRF
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal network infrastructure. The endpoint was accessible to non-staff group owners. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31T17:41:44.893Z
Updated: 2026-04-01T13:47:00.577Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33074 |
vulnerable | 2026-06-08 07:57:18.553182 |
Discourse: Vulnerability in discourse-subscriptions plugin allowing users to self-grant to higher tier subscriptions
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31T17:41:32.012Z
Updated: 2026-03-31T18:52:20.144Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33073 |
vulnerable | 2026-06-08 07:57:18.552668 |
discourse-subscriptions plugin leaking stripe API key in multisite environment
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Published: 2026-03-31T17:38:59.916Z
Updated: 2026-04-03T16:16:18.969Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32951 |
vulnerable | 2026-06-08 07:57:18.373838 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32620 |
vulnerable | 2026-06-08 07:57:17.758131 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32619 |
vulnerable | 2026-06-08 07:57:17.757682 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32618 |
vulnerable | 2026-06-08 07:57:17.757120 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32615 |
vulnerable | 2026-06-08 07:57:17.752177 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32607 |
vulnerable | 2026-06-08 07:57:17.745074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32273 |
vulnerable | 2026-06-08 07:57:17.334905 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32243 |
vulnerable | 2026-06-08 07:57:17.294125 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32143 |
vulnerable | 2026-06-08 07:57:16.731070 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32113 |
vulnerable | 2026-06-08 07:57:16.691463 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.