In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-33355 was detected. This vulnerability allows regular participants in private message topics to view whisper posts via the `/private-posts` endpoint, bypassing intended post-type visibility restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33355.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-33393 was detected. This vulnerability allows attackers to bypass spam protection by exploiting improper domain boundary validation in the allowed_spam_host_domains check, enabling domains like attacker-example.com to circumvent restrictions when example.com was allowlisted. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33393.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-33394 was detected. This vulnerability allows moderators to view the first 40 characters of raw post content from private messages and secure categories via the Post Edits admin report, bypassing intended access restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33394.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a high severity vulnerability CVE-2026-29072 was detected. This vulnerability allows users who are not in allowed policy creation groups to create functional policy acceptance widgets in posts under certain conditions, bypassing intended restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29072.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-30888 was detected. This vulnerability allows moderators to escalate their privileges and edit site policy documents (such as ToS, guidelines, and privacy policy) that they are explicitly prohibited from modifying via the suspend/silence endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30888.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-30889 was detected. This vulnerability allows moderators to access metadata of posts they should not have permission to view due to insufficient authorization checks in the discourse-user-notes component. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30889.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-30891 was detected. This vulnerability allows users to access private activity data of other users due to insufficient authorization checks in the user actions endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30891.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-31869 was detected. This vulnerability allows authenticated users to infer hidden group memberships through the ComposerController#mentions endpoint by manipulating the allowed_names parameter, bypassing group member-visibility controls. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31869.
In Istio versions prior to 1.29.1, 1.28.5, and 1.27.8 a high severity vulnerability CVE-2026-31837 was detected. This vulnerability allows attackers to access hardcoded default key material if the JWKS resolver becomes unavailable or the fetch fails, regardless of the use of the RequestAuthentication resource. To address this issue, users should upgrade Istio to versions 1.29.1, 1.28.5 or 1.27.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31837.
Read more Communication and Collaboration Communication Newsflash