In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a high severity vulnerability CVE-2026-29072 was detected. This vulnerability allows users who are not in allowed policy creation groups to create functional policy acceptance widgets in posts under certain conditions, bypassing intended restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-29072.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-30888 was detected. This vulnerability allows moderators to escalate their privileges and edit site policy documents (such as ToS, guidelines, and privacy policy) that they are explicitly prohibited from modifying via the suspend/silence endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30888.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-30889 was detected. This vulnerability allows moderators to access metadata of posts they should not have permission to view due to insufficient authorization checks in the discourse-user-notes component. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30889.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-30891 was detected. This vulnerability allows users to access private activity data of other users due to insufficient authorization checks in the user actions endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-30891.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-31869 was detected. This vulnerability allows authenticated users to infer hidden group memberships through the ComposerController#mentions endpoint by manipulating the allowed_names parameter, bypassing group member-visibility controls. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31869.
In Istio versions prior to 1.29.1, 1.28.5, and 1.27.8 a high severity vulnerability CVE-2026-31837 was detected. This vulnerability allows attackers to access hardcoded default key material if the JWKS resolver becomes unavailable or the fetch fails, regardless of the use of the RequestAuthentication resource. To address this issue, users should upgrade Istio to versions 1.29.1, 1.28.5 or 1.27.8. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31837.
Read more Communication and Collaboration Communication Newsflash
In Mattermost Desktop App versions up to and including 5.13.3 a medium severity vulnerability CVE-2026-1628 was detected. This vulnerability allows a malicious server to expose preload script functionality to untrusted servers when a user opens an external link within the Mattermost app, due to missing listeners restricting navigation to external sites. To address this issue, users should upgrade Mattermost Desktop App to version 5.13.4.0 or higher. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-1628.
Read more Communication
In Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 a high severity vulnerability CVE-2026-26265 was detected. This vulnerability allows any user, including anonymous users, to retrieve private user field values from the directory by exploiting an IDOR in the `directory items` endpoint, bypassing visibility restrictions and potentially exposing sensitive information such as phone numbers or addresses. To address this issue, users should upgrade Discourse to versions 2025.12.2, 2026.1.1, 2026.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26265.
Read more Communication
In Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 a medium severity vulnerability CVE-2026-26207 was detected. This vulnerability allows any authenticated user to interact with policies on posts they do not have permission to view and to enumerate which posts have policies attached, due to missing access checks in the `discourse-policy` plugin. To address this issue, users should upgrade Discourse to versions 2025.12.2, 2026.1.1, 2026.2.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-26207.
Read more Communication