Discourse vulnerabilities

Discourse with the discourse-subscriptions plugin from versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 leaks Stripe API keys across sites in a multisite cluster, potentially exposing Stripe-related information across sites.

Discourse allows an authenticated user to obtain shared draft topic titles by sending an inline onebox request with a matching category_id.

Discourse allows non-staff users to access read receipt information for staff-only posts. Metadata (who read and when) is exposed, but not post content.

Discourse versions before 2026.1.3, 2026.2.2, and 2026.3.0 allow users who lost access to a topic to still interact with polls, including voting and toggling status.

Discourse allows inference of chat channel membership from user search without proper authorization.

In the Discourse discussion platform, versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allowed category group moderators to perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

In Discourse, when the hidden 'prioritize_full_name_in_ux' setting is enabled, user and group display names are rendered without HTML escaping in several assignment-related UI paths. This allows users with assign permission to inject arbitrary HTML/JavaScript that executes in the browser of any user viewing an affected topic.

In Discourse, updating a category description via API does not sanitize the description string, which can lead to XSS attacks. This affects versions from 2026.1.0 before 2026.1.3, 2026.2.0 before 2026.2.2, and 2026.3.0 before 2026.3.0.

In Discourse, an attacker with the ability to create shared AI conversations can inject arbitrary HTML and JavaScript via crafted conversation titles. The payload executes in the browser of any user viewing the onebox preview, potentially allowing session hijacking or unauthorized actions on behalf of the victim.

In Discourse, moderators can export CSV data from admin-restricted reports, bypassing visibility restrictions. This could expose sensitive operational data.

Discourse has a vulnerability in the enter action of StaticController that reads the sso_destination_url cookie and redirects to it with allow_other_host: true without validating the destination URL. Cookies are client-controlled and can be set by attackers.

Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, unauthorized users could obtain information about restricted-visibility topic tags.

Discourse is an open source discussion platform that prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches did not impose an upper limit on limit parameters in multiple controller actions. This lack of restriction may allow users to generate database queries that could exhaust server resources.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can delay the defer queue processing on sites hosted in the same multisite installation.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a malicious user can edit a post in a topic and cause a DoS with a carefully crafted edit reason.

Discourse is an open source discussion platform, where prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is patched in versions 3.0.6 and 3.1.0.beta7.

In the Discourse discussion platform prior to version 3.1.0.beta7 of the `beta` and `tests-passed` branches, a CSP (Content Security Policy) nonce reuse vulnerability was discovered that could allow cross-site scripting (XSS) attacks to bypass CSP protection for anonymous users. Version 3.1.0.beta7 contains a patch.

Discourse is an open source discussion platform with a vulnerability that can cause a denial of service when attempting to create or update a custom sidebar section. This issue has been patched in commit `52b003d915`.

Discourse is an open source discussion platform that has a vulnerability allowing users to bypass topic title validations when editing topics. The issues involve title length, number of emojis in the title, and blank topic titles.

Discourse, an open source discussion platform, has a nonce reuse vulnerability in its Content Security Policy (CSP) that could allow XSS attacks to bypass CSP protection. Currently, there are no known XSS vectors, but if one is discovered, this vulnerability would allow XSS attacks to completely bypass CSP.

Discourse is an open source discussion platform, where prior to version 3.0.4 of the `stable` branch and version 3.1.0.beta5 of the `beta` and `tests-passed` branches, an attacker could use the new topics dismissal endpoint to reveal the number of recently created topics in categories they didn't have access to.