In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27740 was detected. This vulnerability allows attackers to execute stored cross-site scripting (XSS) by injecting malicious payloads through AI-generated content, which is rendered without proper sanitization in the Review Queue interface. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27740.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a high severity vulnerability CVE-2026-27934 was detected. This vulnerability allows unauthorized users to access private topic titles and post excerpts through the user action API endpoint due to missing visibility checks, leading to information disclosure. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27934.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-27935 was detected. This vulnerability allows moderator users to access private topic metadata of admin users through an API endpoint, even when they do not have permission to view those topics. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-27935.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-28282 was detected. This vulnerability allows users with policy creation permissions to bypass restrictions and gain membership in private or restricted groups, potentially granting access to private topics intended only for those groups. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-28282.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-32114 was detected. This vulnerability allows any authenticated user to access restricted metadata about AI personas, features, and LLM models via unscoped status lookups, exposing information such as credit allocations and usage statistics. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1, 2026.1.2, or disable the AI plugin as a workaround. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32114.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-32099 was detected. This vulnerability allows authenticated users to access hidden profile information—such as bio, location, and website—through the user onebox preview, even when hide_profile is enabled. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-32099.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-33395 was detected. This vulnerability allows authenticated users to inject malicious JavaScript through DOT graph definitions in the discourse-graphviz plugin, leading to stored cross-site scripting (XSS) in instances with CSP disabled. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33395.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a low severity vulnerability CVE-2026-33408 was detected. This vulnerability allows moderators to view the first 40 characters of post edits in private messages and private categories, bypassing intended access restrictions. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-33408.
In Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 a medium severity vulnerability CVE-2026-31805 was detected. This vulnerability allows authenticated users to bypass authorization in the poll plugin, enabling them to vote, remove votes, or toggle the open/closed status of polls they should not have access to by manipulating the post_id array parameter. To address this issue, users should upgrade Discourse to versions 2026.3.0-latest.1, 2026.2.1 or 2026.1.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-31805.