Communication and Collaboration

In LimeSurvey versions up to and including 4.3.10 a medium severity vulnerability CVE-2020-36993 was detected. This vulnerability allows attackers to inject malicious SVG scripts through the Survey Menu parameters, enabling the execution of arbitrary JavaScript in administrative contexts. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2020-36993.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68934 was detected. This vulnerability allows authenticated users to trigger a denial of service by submitting crafted payloads to the /drafts.json endpoint, causing inefficient O(n²) processing in Base62.decode and tying up worker processes for extended periods. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68934.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 a high severity vulnerability CVE-2025-68933 was detected. This vulnerability allows non-administrator moderators, when the moderators_change_post_ownership setting is enabled, to change ownership of posts in private messages and restricted categories they cannot access, then export the data to view the private content. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68933.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68666 was detected. This vulnerability allows users with moderation privileges to access user archives that should be restricted to administrators only, resulting in the exposure of private topic and post content and a breach of confidentiality. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68666.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a high severity vulnerability CVE-2025-68662 was detected. This vulnerability allows attackers to bypass Server-Side Request Forgery (SSRF) protections under certain conditions due to improper hostname validation in the FinalDestination component. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68662.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2025-68660 was detected. This vulnerability allows authenticated users to bypass ai_discover_persona access controls, gain unauthorized direct message access to AI personas connected to staff-only resources, and impersonate other users by supplying arbitrary user IDs, potentially leading to unauthorized data disclosure and abusive or misleading private message activity. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-68660.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2026-24742 was detected. This vulnerability allows non-administrator moderators to access sensitive administrator-only data via staff action logs, including webhook secrets, API keys, private messages, and restricted settings, potentially enabling confidential data leakage and webhook spoofing. To address this issue, users should upgrade Discourse versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-24742.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1 and 2026.1.0 a medium severity vulnerability CVE-2026-23743 was detected. This vulnerability allows unauthorized users to infer sensitive information about access-restricted resources, such as private topic titles, categories, posts, or hidden tags, via permalink redirects that expose resource slugs in the redirect Location header and the 404 page search box. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-23743.

In Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 a medium severity vulnerability CVE-2026-21865 was detected. This vulnerability allows moderators to improperly convert certain personal messages into public topics, bypassing intended permission restrictions. To address this issue, users should upgrade Discourse to versions 3.5.4, 2025.11.2, 2025.12.1 or 2026.1.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-21865.