Communication and Collaboration

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-45085 was detected. This vulnerability encompasses four distinct misauthorization and information disclosure issues within the chat plugin, with one also involving the discourse-calendar plugin. The flaws allow read-only category users to create chat threads and permit authors to restore self-deleted messages even after their channel access has been revoked. Furthermore, it causes information disclosure by exposing a channel’s last_message (which can include unrelated direct message content) to moderators reviewing flagged messages, and by leaking chat channel details via calendar event payloads to unauthorized viewers, including anonymous users. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-45085.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47264 was detected. This vulnerability allows an unprivileged or anonymous user to view the names of restricted tag groups, leading to information disclosure. This occurs because the DetailedTagSerializer#tag_group_names function returns every tag group a tag belongs to without properly filtering against the requesting user’s visibility permissions. When the SiteSetting.tags_listed_by_group setting is enabled, hitting the TagsController#info endpoint (which is exempt from login requirements) exposes the names of tag groups that should be restricted to specific user groups or non-visible categories. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47264.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-47263 was detected. This vulnerability allows an authenticated user (or an anonymous user if login_required is disabled) to access sensitive webhook payloads, leading to information disclosure. This occurs because the MessageBus.publish call for the /web_hook_events/<id> endpoint within Jobs::RedeliverWebHookEvents fails to pass the group_ids parameter. As a result, the communication channel remains readable by unintended users. Since webhook IDs are sequential integers, an attacker can easily enumerate them to access arbitrary event redelivery payloads. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-47263.

In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a high severity vulnerability CVE-2026-7387 was detected. This vulnerability allows an authenticated user with group-link permissions to escalate their own privileges, as well as the privileges of other group members, to team or channel administrator. This occurs because the application fails to enforce proper role-management authorization checks when setting the scheme_admin flag on group syncable link and patch endpoints. An attacker can exploit this flaw by submitting crafted API requests. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, and 10.11.17. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7387.

In Mattermost versions 11.6.x up to 11.6.1, 11.5.x up to 11.5.4, and 10.11.x up to 10.11.16 a medium severity vulnerability CVE-2026-6689 was detected. This vulnerability allows an authenticated user with team creation permissions to bypass intended access controls and configure invite-related settings. This occurs due to a missing PermissionInviteUser check when setting AllowOpenInvite or AllowedDomains during the initial team creation process via the POST /api/v4/teams endpoint. While the system properly enforces this check when updating an existing team, this flaw allows a user to create a team that is publicly joinable or restricted to specific domains without having the actual permission to invite users. To address this issue, users should upgrade Mattermost to a patched version 11.6.2, 11.5.5, 10.11.17, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-6689.

In Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1 a medium severity vulnerability CVE-2026-44783 was detected. This vulnerability allows authenticated users outside of the allowed groups to post unauthorized messages into a topic’s staff-only whisper channel. This occurs due to a flaw in how replies to whisper posts are handled on sites where the whispers feature is enabled. As a result, the injected content becomes visible to authorized whisperers (typically staff members) alongside legitimate whispers. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44783.

In LimeSurvey all versions a high severity vulnerability CVE-2026-50635 was detected. This vulnerability allows a remote, unauthenticated attacker to take over a user’s account. This occurs due to a Host Header Injection flaw where LimeSurvey constructs account password-reset links using the unvalidated, client-supplied HTTP Host header (because the allowedHosts allowlist is undefined in the default configuration). By submitting a forgotten-password request with a spoofed Host header, the attacker causes the system to email a reset link pointing to an attacker-controlled server but containing a genuine validation_key. When the victim or an automated email scanner dereferences the link, the token is disclosed to the attacker, who can then use it on the legitimate site to set a new password. To address this issue, users should upgrade LimeSurvey to version version 7.x or the latest 6.x patch release and ensure the allowedHosts parameter is properly configured. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50635.

In Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 a medium severity vulnerability CVE-2026-32244 was detected. This vulnerability allows anonymous and unprivileged users to view removed content, leading to information disclosure. This occurs because the platform caches outdated AI-generated summaries which are not adequately purged when the original content is deleted. Consequently, users who lack the permissions to regenerate summaries can still access the leaked information through the stale cache. To address this issue, users should upgrade Discourse to versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1. As a temporary workaround, administrators can restrict summary generation by tightening the allowed groups on the summarization Personas. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32244.

In Twenty CRM versions 1.7.7 through 1.16.7 a critical severity vulnerability CVE-2026-46624 was detected. This vulnerability allows an authenticated user to execute arbitrary OS commands on the database server (Remote Code Execution) if the Postgres user is a superuser. This occurs due to a chained SQL Injection and PostgreSQL COPY TO PROGRAM attack, where the timeZone field within the group_by query parameter in the REST API is directly interpolated into a raw SQL expression without any parameterization, validation, or escaping. There’s no fix available for this issue at the moment.. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46624.