In Mattermost Plugins versions 11.3, 11.0.3, 11.2.2, and 10.10.11.0 and earlier a medium severity vulnerability CVE-2026-2461 was detected. This vulnerability allows an authorized attacker with editor permissions to modify comments created by other board members due to missing authorization checks on comment block modifications. Currently, there is no fix version for this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2461.
Read more Communication
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27454 was detected. This vulnerability allows attackers to bypass authorization checks and access hidden post revisions by requesting specific version parameters in the /posts/:id.json endpoint. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27454.
Read more Communication
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27166 was detected. This vulnerability allows attackers to perform HTML injection by exploiting insufficient sanitization of the default Codepen allowed iframes, potentially tricking users into changing the main page URL. To address this issue, users should upgrade to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27166.
Read more Communication
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27491 was detected. This vulnerability allows non-staff users to issue official warnings to other users by exploiting a type coercion issue in a post actions API endpoint, bypassing intended staff-only restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27491.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27570 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) by injecting malicious content into the conversation title, which is rendered without proper sanitization in the Shared AI Conversation onebox. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27570.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27740 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) by injecting malicious payloads through AI-generated content, which is rendered without proper sanitization in the Review Queue interface. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27740.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a high severity vulnerability CVE-2026-27934 was detected. This vulnerability allows unauthorized users to access private topic titles and post excerpts through the user action API endpoint due to missing visibility checks, leading to information disclosure. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27934.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27935 was detected. This vulnerability allows moderator users to access private topic metadata of admin users through an API endpoint, even when they do not have permission to view those topics. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27935.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-28282 was detected. This vulnerability allows users with policy creation permissions to bypass restrictions and gain membership in private or restricted groups, potentially granting access to private topics intended only for those groups. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28282.