Search
Find a vulnerability
Search criteria
590 vulnerabilities found for Discourse by Discourse
CVE-2017-20290 (GCVE-0-2017-20290)
Vulnerability from nvd – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57 X_Known Exploited Vulnerability Unsupported When AssignedTitle
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Summary
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/commit/a6f… | patch |
| https://github.com/discourse/discourse/commit/6e3… | technical-descriptionpatch |
| https://github.com/projectdiscovery/nuclei-templa… | technical-description |
| https://www.vulncheck.com/advisories/discourse-1.… | third-party-advisory |
Impacted products
Date Public
2017-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/discourse/discourse",
"product": "Discourse",
"repo": "https://github.com/discourse/discourse",
"vendor": "Discourse",
"versions": [
{
"lessThan": "1.9.0.beta13",
"status": "affected",
"version": "1.9.0.beta2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0.beta13",
"versionStartIncluding": "1.9.0.beta2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "The Shadowserver Foundation"
}
],
"datePublic": "2017-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims\u0027 browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:24.711Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fix Commit",
"tags": [
"patch"
],
"url": "https://github.com/discourse/discourse/commit/a6f2533d38"
},
{
"name": "Introducing Commit",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/discourse/discourse/commit/6e37f09b19"
},
{
"name": "Nuclei Template",
"tags": [
"technical-description"
],
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yaml"
},
{
"name": "VulnCheck Advisory: Discourse \u003c 1.9.0.beta13 Reflected XSS via /email/unsubscribed",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribed"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability",
"unsupported-when-assigned"
],
"title": "Discourse \u003c 1.9.0.beta13 Reflected XSS via /email/unsubscribed",
"x_generator": {
"engine": "vulncheck-kclub"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2017-20290",
"datePublished": "2026-10-22T10:57:24.711Z",
"dateReserved": "2026-10-14T20:25:25.755Z",
"dateUpdated": "2026-10-22T10:57:24.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91159 (GCVE-0-2026-91159)
Vulnerability from nvd – Published: 2026-10-14 15:30 – Updated: 2026-10-20 01:33
VLAI
EPSS
VEX
Title
Discourse: Stored oEmbed HTML injection via allowed iframe
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/095… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3fc… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/dde… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed6… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:33:46.177897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:33:56.005Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:30:14.190Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282"
},
{
"name": "https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22"
},
{
"name": "https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a"
},
{
"name": "https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3"
},
{
"name": "https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7"
}
],
"source": {
"advisory": "GHSA-f9jx-vv33-4282",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored oEmbed HTML injection via allowed iframe"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91159",
"datePublished": "2026-10-14T15:30:14.190Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-10-20T01:33:56.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91157 (GCVE-0-2026-91157)
Vulnerability from nvd – Published: 2026-10-14 15:37 – Updated: 2026-10-20 01:35
VLAI
EPSS
VEX
Title
Discourse: Media uploads remain publicly accessible after category permissions are restricted
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:35 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/160… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/83f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/98f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b2f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:35:15.783931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:35:25.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:37:02.240Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3"
},
{
"name": "https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab"
},
{
"name": "https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708"
},
{
"name": "https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7"
},
{
"name": "https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458"
}
],
"source": {
"advisory": "GHSA-298h-xgw6-4pv3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Media uploads remain publicly accessible after category permissions are restricted"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91157",
"datePublished": "2026-10-14T15:37:02.240Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-10-20T01:35:25.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91156 (GCVE-0-2026-91156)
Vulnerability from nvd – Published: 2026-10-14 15:33 – Updated: 2026-10-14 17:42
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/046… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/87b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ba7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cac… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:41:47.693023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:42:03.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site\u0027s group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel\u0027s full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:33:33.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q"
},
{
"name": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e"
},
{
"name": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb"
},
{
"name": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1"
},
{
"name": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"
}
],
"source": {
"advisory": "GHSA-gh4f-qr62-vx8q",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91156",
"datePublished": "2026-10-14T15:33:33.121Z",
"dateReserved": "2026-09-14T21:20:41.195Z",
"dateUpdated": "2026-10-14T17:42:03.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91121 (GCVE-0-2026-91121)
Vulnerability from nvd – Published: 2026-09-24 17:05 – Updated: 2026-09-24 17:27
VLAI
EPSS
VEX
Title
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/24c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6e7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/9d6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/af1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:27:35.450393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:27:43.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:05:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278"
},
{
"name": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787"
},
{
"name": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b"
},
{
"name": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"
}
],
"source": {
"advisory": "GHSA-34rh-wjfv-65gq",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat upload filenames rendered as raw HTML in excerpts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91121",
"datePublished": "2026-09-24T17:05:20.530Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:27:43.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91120 (GCVE-0-2026-91120)
Vulnerability from nvd – Published: 2026-09-24 17:00 – Updated: 2026-09-24 17:24
VLAI
EPSS
VEX
Title
Discourse: Stored HTML injection in video notification emails
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6bf… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/833… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e7d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:24:51.329319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:24:59.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:00:05.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f"
},
{
"name": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3"
},
{
"name": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76"
},
{
"name": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"
}
],
"source": {
"advisory": "GHSA-h7cg-2vww-m45c",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored HTML injection in video notification emails"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91120",
"datePublished": "2026-09-24T17:00:05.331Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:24:59.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91119 (GCVE-0-2026-91119)
Vulnerability from nvd – Published: 2026-09-24 17:07 – Updated: 2026-09-28 15:00
VLAI
EPSS
VEX
Title
Discourse: Encode action_code_who in mention URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/77a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c47… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:51.871193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:00:02.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:07:04.367Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c"
},
{
"name": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035"
},
{
"name": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a"
},
{
"name": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"
}
],
"source": {
"advisory": "GHSA-pv3p-p3m9-v8v3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Encode action_code_who in mention URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91119",
"datePublished": "2026-09-24T17:07:04.367Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-28T15:00:02.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91134 (GCVE-0-2026-91134)
Vulnerability from nvd – Published: 2026-09-24 16:51 – Updated: 2026-09-29 02:56
VLAI
EPSS
VEX
Title
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:56 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0a8… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/130… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/bac… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fed… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:56:20.350456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:56:30.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:51:34.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415"
},
{
"name": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590"
},
{
"name": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d"
},
{
"name": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"
}
],
"source": {
"advisory": "GHSA-54vw-chv3-wjpv",
"discovery": "UNKNOWN"
},
"title": "Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91134",
"datePublished": "2026-09-24T16:51:34.057Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:56:30.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91133 (GCVE-0-2026-91133)
Vulnerability from nvd – Published: 2026-09-24 16:53 – Updated: 2026-09-24 17:12
VLAI
EPSS
VEX
Title
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:12 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/113… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a04… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cb3… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:12:40.098136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:12:50.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:53:00.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52"
},
{
"name": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f"
},
{
"name": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd"
},
{
"name": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"
}
],
"source": {
"advisory": "GHSA-8hxh-573g-52gx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91133",
"datePublished": "2026-09-24T16:53:00.147Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-24T17:12:50.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91132 (GCVE-0-2026-91132)
Vulnerability from nvd – Published: 2026-09-24 16:57 – Updated: 2026-09-29 02:57
VLAI
EPSS
VEX
Title
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:57 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/809… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d88… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/db8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:57:23.434341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:57:34.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:57:43.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5"
},
{
"name": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a"
},
{
"name": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9"
},
{
"name": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"
}
],
"source": {
"advisory": "GHSA-4q3q-hph3-3rvp",
"discovery": "UNKNOWN"
},
"title": "Discourse: Wildcard iframe origin allowlist bypass via authority separators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91132",
"datePublished": "2026-09-24T16:57:43.082Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:57:34.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91123 (GCVE-0-2026-91123)
Vulnerability from nvd – Published: 2026-09-24 16:54 – Updated: 2026-09-24 17:11
VLAI
EPSS
VEX
Title
Discourse: Reject literal backslash path separators in iframe src traversal guard
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:11 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/042… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/097… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0b5… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/142… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:11:25.606443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:11:34.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:54:59.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318"
},
{
"name": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24"
},
{
"name": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be"
},
{
"name": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"
}
],
"source": {
"advisory": "GHSA-6pwj-wgg8-4rjc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Reject literal backslash path separators in iframe src traversal guard"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91123",
"datePublished": "2026-09-24T16:54:59.357Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:11:34.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91122 (GCVE-0-2026-91122)
Vulnerability from nvd – Published: 2026-09-24 16:56 – Updated: 2026-09-24 17:25
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/05d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/567… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c39… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d71… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:25:16.666454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:25:54.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer\u0027s session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:56:26.568Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d"
},
{
"name": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031"
},
{
"name": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda"
},
{
"name": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"
}
],
"source": {
"advisory": "GHSA-8m44-f6g9-7cg7",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91122",
"datePublished": "2026-09-24T16:56:26.568Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:25:54.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84302 (GCVE-0-2026-84302)
Vulnerability from nvd – Published: 2026-09-24 16:49 – Updated: 2026-09-24 17:04
VLAI
EPSS
VEX
Title
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:04 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/156… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/38d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b32… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:04:31.550424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:04:51.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:49:56.499Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427"
},
{
"name": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5"
},
{
"name": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd"
},
{
"name": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"
}
],
"source": {
"advisory": "GHSA-3rx9-fqgh-wfpc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84302",
"datePublished": "2026-09-24T16:49:56.499Z",
"dateReserved": "2026-09-01T16:17:43.078Z",
"dateUpdated": "2026-09-24T17:04:51.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59830 (GCVE-0-2026-59830)
Vulnerability from nvd – Published: 2026-09-21 21:17 – Updated: 2026-09-22 15:38
VLAI
EPSS
VEX
Title
Discourse: Stored XSS via unescaped actor name in post actions
Summary
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/dd7… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T14:12:11.883033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:38:41.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user\u0027s browser. This issue is fixed in version 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:17:38.733Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw"
},
{
"name": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.7.0"
}
],
"source": {
"advisory": "GHSA-x6mf-p7cg-69rw",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS via unescaped actor name in post actions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59830",
"datePublished": "2026-09-21T21:17:38.733Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-09-22T15:38:41.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59829 (GCVE-0-2026-59829)
Vulnerability from nvd – Published: 2026-08-17 15:26 – Updated: 2026-08-17 19:00
VLAI
EPSS
VEX
Title
Discourse: Review queue exposes flag-related private message excerpts to category group moderators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 19:00 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/41527 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/4df… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/58e… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/74c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e56… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59829",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T19:00:39.979003Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T19:00:49.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category\u0027s moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator\u0027s group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:26:53.835Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w"
},
{
"name": "https://github.com/discourse/discourse/pull/41527",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/41527"
},
{
"name": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59"
},
{
"name": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754"
},
{
"name": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa"
},
{
"name": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9"
}
],
"source": {
"advisory": "GHSA-wmc6-pmxp-xw5w",
"discovery": "UNKNOWN"
},
"title": "Discourse: Review queue exposes flag-related private message excerpts to category group moderators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59829",
"datePublished": "2026-08-17T15:26:53.835Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-08-17T19:00:49.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55704 (GCVE-0-2026-55704)
Vulnerability from nvd – Published: 2026-08-17 15:31 – Updated: 2026-08-17 22:02
VLAI
EPSS
VEX
Title
Discourse: Shared-draft titles and excerpts leak through group post serialization
Summary
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 21:29 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T21:29:14.994826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T22:02:06.167Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.6"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group\u2019s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T15:31:41.130Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8"
}
],
"source": {
"advisory": "GHSA-fxw4-38v9-76v8",
"discovery": "UNKNOWN"
},
"title": "Discourse: Shared-draft titles and excerpts leak through group post serialization"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55704",
"datePublished": "2026-08-17T15:31:41.130Z",
"dateReserved": "2026-06-17T00:13:10.651Z",
"dateUpdated": "2026-08-17T22:02:06.167Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2017-20290 (GCVE-0-2017-20290)
Vulnerability from cvelistv5 – Published: 2026-10-22 10:57 – Updated: 2026-10-22 10:57 X_Known Exploited Vulnerability Unsupported When AssignedTitle
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
Summary
Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
Severity
6.1 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/commit/a6f… | patch |
| https://github.com/discourse/discourse/commit/6e3… | technical-descriptionpatch |
| https://github.com/projectdiscovery/nuclei-templa… | technical-description |
| https://www.vulncheck.com/advisories/discourse-1.… | third-party-advisory |
Impacted products
Date Public
2017-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/discourse/discourse",
"product": "Discourse",
"repo": "https://github.com/discourse/discourse",
"vendor": "Discourse",
"versions": [
{
"lessThan": "1.9.0.beta13",
"status": "affected",
"version": "1.9.0.beta2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.0.beta13",
"versionStartIncluding": "1.9.0.beta2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "The Shadowserver Foundation"
}
],
"datePublic": "2017-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims\u0027 browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T10:57:24.711Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Fix Commit",
"tags": [
"patch"
],
"url": "https://github.com/discourse/discourse/commit/a6f2533d38"
},
{
"name": "Introducing Commit",
"tags": [
"technical-description",
"patch"
],
"url": "https://github.com/discourse/discourse/commit/6e37f09b19"
},
{
"name": "Nuclei Template",
"tags": [
"technical-description"
],
"url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/discourse-xss.yaml"
},
{
"name": "VulnCheck Advisory: Discourse \u003c 1.9.0.beta13 Reflected XSS via /email/unsubscribed",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/discourse-1.9.0-beta13-reflected-xss-via-email-unsubscribed"
}
],
"source": {
"discovery": "UNKNOWN"
},
"tags": [
"x_known-exploited-vulnerability",
"unsupported-when-assigned"
],
"title": "Discourse \u003c 1.9.0.beta13 Reflected XSS via /email/unsubscribed",
"x_generator": {
"engine": "vulncheck-kclub"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2017-20290",
"datePublished": "2026-10-22T10:57:24.711Z",
"dateReserved": "2026-10-14T20:25:25.755Z",
"dateUpdated": "2026-10-22T10:57:24.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91157 (GCVE-0-2026-91157)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:37 – Updated: 2026-10-20 01:35
VLAI
EPSS
VEX
Title
Discourse: Media uploads remain publicly accessible after category permissions are restricted
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:35 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/160… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/83f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/98f… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b2f… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:35:15.783931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:35:25.492Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:37:02.240Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3"
},
{
"name": "https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab"
},
{
"name": "https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708"
},
{
"name": "https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7"
},
{
"name": "https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458"
}
],
"source": {
"advisory": "GHSA-298h-xgw6-4pv3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Media uploads remain publicly accessible after category permissions are restricted"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91157",
"datePublished": "2026-10-14T15:37:02.240Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-10-20T01:35:25.492Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91156 (GCVE-0-2026-91156)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:33 – Updated: 2026-10-14 17:42
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 17:41 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/046… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/87b… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ba7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cac… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T17:41:47.693023Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T17:42:03.003Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site\u0027s group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel\u0027s full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:33:33.121Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-gh4f-qr62-vx8q"
},
{
"name": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/046fb7bfd68a5b95e63dda88c3c73877c5cf9d5e"
},
{
"name": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/87b31bf60a7827f075634254379a1dcbaba409cb"
},
{
"name": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ba74bb404ab4439f5b1f0204e848d62099db8ae1"
},
{
"name": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cac1f26f275cec3dc1dd51dfdac2b3d1a4ec50f8"
}
],
"source": {
"advisory": "GHSA-gh4f-qr62-vx8q",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91156",
"datePublished": "2026-10-14T15:33:33.121Z",
"dateReserved": "2026-09-14T21:20:41.195Z",
"dateUpdated": "2026-10-14T17:42:03.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91159 (GCVE-0-2026-91159)
Vulnerability from cvelistv5 – Published: 2026-10-14 15:30 – Updated: 2026-10-20 01:33
VLAI
EPSS
VEX
Title
Discourse: Stored oEmbed HTML injection via allowed iframe
Summary
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 01:33 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/095… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/3fc… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/dde… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed6… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T01:33:46.177897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T01:33:56.005Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.1.9"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.3"
},
{
"status": "affected",
"version": "\u003e= 2026.8.0-latest, \u003c 2026.8.1"
},
{
"status": "affected",
"version": "\u003e= 2026.9.0-latest, \u003c 2026.9.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T15:30:14.190Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-f9jx-vv33-4282"
},
{
"name": "https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0953b31f5c2949d7d6ab5f6dc4c5e2f1b8bf0b22"
},
{
"name": "https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/3fc2bad6cdca47b00958330d1ee612aa141b039a"
},
{
"name": "https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dde8bc4fb6200139f5eff7e100b0f3e829d37ab3"
},
{
"name": "https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed6f83f123d1a4c6c6c7e64c8a2233e3cb6a28d7"
}
],
"source": {
"advisory": "GHSA-f9jx-vv33-4282",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored oEmbed HTML injection via allowed iframe"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91159",
"datePublished": "2026-10-14T15:30:14.190Z",
"dateReserved": "2026-09-14T21:20:41.196Z",
"dateUpdated": "2026-10-20T01:33:56.005Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91119 (GCVE-0-2026-91119)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:07 – Updated: 2026-09-28 15:00
VLAI
EPSS
VEX
Title
Discourse: Encode action_code_who in mention URLs
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-28 14:59 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/666… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/77a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c47… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-28T14:59:51.871193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-28T15:00:02.275Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:07:04.367Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c"
},
{
"name": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035"
},
{
"name": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a"
},
{
"name": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168"
}
],
"source": {
"advisory": "GHSA-pv3p-p3m9-v8v3",
"discovery": "UNKNOWN"
},
"title": "Discourse: Encode action_code_who in mention URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91119",
"datePublished": "2026-09-24T17:07:04.367Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-28T15:00:02.275Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91121 (GCVE-0-2026-91121)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:05 – Updated: 2026-09-24 17:27
VLAI
EPSS
VEX
Title
Discourse: Chat upload filenames rendered as raw HTML in excerpts
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:27 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/24c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6e7… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/9d6… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/af1… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91121",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:27:35.450393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:27:43.580Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:05:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278"
},
{
"name": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787"
},
{
"name": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b"
},
{
"name": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836"
}
],
"source": {
"advisory": "GHSA-34rh-wjfv-65gq",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat upload filenames rendered as raw HTML in excerpts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91121",
"datePublished": "2026-09-24T17:05:20.530Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:27:43.580Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91120 (GCVE-0-2026-91120)
Vulnerability from cvelistv5 – Published: 2026-09-24 17:00 – Updated: 2026-09-24 17:24
VLAI
EPSS
VEX
Title
Discourse: Stored HTML injection in video notification emails
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:24 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/6bf… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/833… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/e7d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/ed8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91120",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:24:51.329319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:24:59.169Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:00:05.331Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f"
},
{
"name": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3"
},
{
"name": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76"
},
{
"name": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd"
}
],
"source": {
"advisory": "GHSA-h7cg-2vww-m45c",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored HTML injection in video notification emails"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91120",
"datePublished": "2026-09-24T17:00:05.331Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:24:59.169Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91132 (GCVE-0-2026-91132)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:57 – Updated: 2026-09-29 02:57
VLAI
EPSS
VEX
Title
Discourse: Wildcard iframe origin allowlist bypass via authority separators
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:57 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/809… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d5a… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d88… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/db8… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91132",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:57:23.434341Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:57:34.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:57:43.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5"
},
{
"name": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a"
},
{
"name": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9"
},
{
"name": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56"
}
],
"source": {
"advisory": "GHSA-4q3q-hph3-3rvp",
"discovery": "UNKNOWN"
},
"title": "Discourse: Wildcard iframe origin allowlist bypass via authority separators"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91132",
"datePublished": "2026-09-24T16:57:43.082Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:57:34.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91122 (GCVE-0-2026-91122)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:56 – Updated: 2026-09-24 17:25
VLAI
EPSS
VEX
Title
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:25 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/05d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/567… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/c39… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/d71… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91122",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:25:16.666454Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:25:54.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer\u0027s session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:56:26.568Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d"
},
{
"name": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031"
},
{
"name": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda"
},
{
"name": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8"
}
],
"source": {
"advisory": "GHSA-8m44-f6g9-7cg7",
"discovery": "UNKNOWN"
},
"title": "Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91122",
"datePublished": "2026-09-24T16:56:26.568Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:25:54.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91123 (GCVE-0-2026-91123)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:54 – Updated: 2026-09-24 17:11
VLAI
EPSS
VEX
Title
Discourse: Reject literal backslash path separators in iframe src traversal guard
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:11 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/042… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/097… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0b5… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/142… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91123",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:11:25.606443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:11:34.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:54:59.357Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318"
},
{
"name": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24"
},
{
"name": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be"
},
{
"name": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579"
}
],
"source": {
"advisory": "GHSA-6pwj-wgg8-4rjc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Reject literal backslash path separators in iframe src traversal guard"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91123",
"datePublished": "2026-09-24T16:54:59.357Z",
"dateReserved": "2026-09-14T19:36:48.843Z",
"dateUpdated": "2026-09-24T17:11:34.752Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91133 (GCVE-0-2026-91133)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:53 – Updated: 2026-09-24 17:12
VLAI
EPSS
VEX
Title
Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:12 UTC
CWE
- CWE-943 - Improper Neutralization of Special Elements in Data Query Logic
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/113… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/20c… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/a04… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/cb3… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91133",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:12:40.098136Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:12:50.099Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-943",
"description": "CWE-943: Improper Neutralization of Special Elements in Data Query Logic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:53:00.147Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52"
},
{
"name": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f"
},
{
"name": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd"
},
{
"name": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6"
}
],
"source": {
"advisory": "GHSA-8hxh-573g-52gx",
"discovery": "UNKNOWN"
},
"title": "Discourse: Escape LIKE metacharacters in upload paths to prevent disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91133",
"datePublished": "2026-09-24T16:53:00.147Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-24T17:12:50.099Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-91134 (GCVE-0-2026-91134)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:51 – Updated: 2026-09-29 02:56
VLAI
EPSS
VEX
Title
Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:56 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42882 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/0a8… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/130… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/bac… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/fed… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-91134",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:56:20.350456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:56:30.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.8.0"
},
{
"status": "affected",
"version": "\u003e= 2026.7.0-latest, \u003c 2026.7.2"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.3"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:51:34.057Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv"
},
{
"name": "https://github.com/discourse/discourse/pull/42882",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42882"
},
{
"name": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415"
},
{
"name": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590"
},
{
"name": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d"
},
{
"name": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64"
}
],
"source": {
"advisory": "GHSA-54vw-chv3-wjpv",
"discovery": "UNKNOWN"
},
"title": "Discourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-91134",
"datePublished": "2026-09-24T16:51:34.057Z",
"dateReserved": "2026-09-14T19:36:48.844Z",
"dateUpdated": "2026-09-29T02:56:30.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84302 (GCVE-0-2026-84302)
Vulnerability from cvelistv5 – Published: 2026-09-24 16:49 – Updated: 2026-09-24 17:04
VLAI
EPSS
VEX
Title
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 17:04 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/pull/42091 | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/156… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/234… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/38d… | x_refsource_MISC |
| https://github.com/discourse/discourse/commit/b32… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84302",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T17:04:31.550424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T17:04:51.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
},
{
"status": "affected",
"version": "\u003e= 2026.6.0-latest, \u003c 2026.6.1"
},
{
"status": "affected",
"version": "\u003e= 2026.5.0-latest, \u003c 2026.5.2"
},
{
"status": "affected",
"version": "\u003e= 2026.1.0-latest, \u003c 2026.1.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T16:49:56.499Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc"
},
{
"name": "https://github.com/discourse/discourse/pull/42091",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/pull/42091"
},
{
"name": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427"
},
{
"name": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5"
},
{
"name": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd"
},
{
"name": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f"
}
],
"source": {
"advisory": "GHSA-3rx9-fqgh-wfpc",
"discovery": "UNKNOWN"
},
"title": "Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84302",
"datePublished": "2026-09-24T16:49:56.499Z",
"dateReserved": "2026-09-01T16:17:43.078Z",
"dateUpdated": "2026-09-24T17:04:51.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59830 (GCVE-0-2026-59830)
Vulnerability from cvelistv5 – Published: 2026-09-21 21:17 – Updated: 2026-09-22 15:38
VLAI
EPSS
VEX
Title
Discourse: Stored XSS via unescaped actor name in post actions
Summary
Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user's browser. This issue is fixed in version 2026.7.0.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 14:12 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/discourse/discourse/security/a… | x_refsource_CONFIRM |
| https://github.com/discourse/discourse/commit/dd7… | x_refsource_MISC |
| https://github.com/discourse/discourse/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T14:12:11.883033Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:38:41.155Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "discourse",
"vendor": "discourse",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names before interpolating them into an HTML string passed to trustHTML. A user who could choose a crafted display name could persist markup in post action descriptions. Viewing the affected user activity streams could execute attacker-controlled script in another user\u0027s browser. This issue is fixed in version 2026.7.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T21:17:38.733Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/discourse/discourse/security/advisories/GHSA-x6mf-p7cg-69rw"
},
{
"name": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/commit/dd786594ddd088657a7e6f9fefba5bd889965fe4"
},
{
"name": "https://github.com/discourse/discourse/releases/tag/v2026.7.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/discourse/discourse/releases/tag/v2026.7.0"
}
],
"source": {
"advisory": "GHSA-x6mf-p7cg-69rw",
"discovery": "UNKNOWN"
},
"title": "Discourse: Stored XSS via unescaped actor name in post actions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59830",
"datePublished": "2026-09-21T21:17:38.733Z",
"dateReserved": "2026-07-07T15:00:50.979Z",
"dateUpdated": "2026-09-22T15:38:41.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}