PatchTheCVE: discourse

CVE-2026-47264: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:40:35 +0000

MEDIUM 5.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, DetailedTagSerializer#tag_group_names returned every tag group a tag belonged to without filtering against the requesting use

CVE-2026-47263: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:41:27 +0000

MEDIUM 4.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the MessageBus.publish call for /web_hook_events/ in Jobs::RedeliverWebHookEvents did not pass group_ids, leaving the cha

CVE-2026-45775: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:41:42 +0000

MEDIUM 6.8: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a path traversal vulnerability in Discourse backup handling could allow an authenticated administrator on one site in a multi

CVE-2026-45085: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:46:25 +0000

MEDIUM 5.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclosure issues in the chat plugin (one also involving discourse-calendar): read-only category users cou

CVE-2026-44786: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:46:46 +0000

HIGH 7.5: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber

CVE-2026-44785: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:47:00 +0000

MEDIUM 4.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user wi

CVE-2026-44784: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:50:24 +0000

MEDIUM 6.5: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, group owners who are not necessarily admins or moderators can view a group's outgoing email/SMTP credentials in plaintext via

CVE-2026-44783: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:55:51 +0000

MEDIUM 5.4: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispers_allow

CVE-2026-44782: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:55:58 +0000

MEDIUM 4.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared include_user_long_name? as the predicate for its :name attribute, but AMS looks for include_name

CVE-2026-44780: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 18:56:03 +0000

MEDIUM 4.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts that arrived via incoming email. Categ

CVE-2026-44779: Discourse is an open-source discussion platform

Wed, 17 Jun 2026 14:52:31 +0000

MEDIUM 4.3: Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints disclose whisper translation audit logs. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026