Threat database

CVE-2026-57447 is a medium severity vulnerability in the discourse-doc-categories plugin for Discourse. The issue involves exposure of sensitive information where the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing viewer authorization. This allows a user with permission to edit the index topic to learn titles of topics they are not authorized to view, though access to the topic contents is not granted. The vulnerability has been addressed by a specific commit in the source code.

CVE-2026-55103 is a vulnerability in the discourse-activity-pub plugin for Discourse that allows remote attackers to edit, delete, or reply to federated posts without proper permissions due to insufficient verification of the actor's identity and ownership of the post. This issue was fixed in commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5. The vulnerability has a high severity with a CVSS score of 8.6.

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, Codepen is present in the default `allowed_iframes` site setting, and it can potentially auto-run arbitrary JS in the iframe scope, which is unintended. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. As a workaround, the Codepen prefix can be removed from a site's `allowed_iframes`.

EPSS 0.4%Vulnerability#cwe-1038Germany+7

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML. This includes inviting someone (without an account) to a PM and inviting someone (without an account) to a topic with a custom message. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. This can be worked around if the relevant templates are overridden without `{topic_title}`.

EPSS 0.3%Vulnerability#cwe-116#cwe-79Germany+9

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch, sending a malicious URL in a PM to a bot user can cause a reduced the availability of a Discourse instance. This issue is patched in version 3.4.4 of the `stable` branch, version 3.5.0.beta5 of the `beta` branch, and version 3.5.0.beta6-dev of the `tests-passed` branch. No known workarounds are available.

EPSS 0.4%Vulnerability#cwe-400#cwe-770Germany+6

Discourse Policy plugin gives the ability to confirm users have seen or done something. Prior to version 0.1.1, if there was a policy posted to a public topic that was tied to a private group then the group members could be shown to non-group members. This issue has been patched in version 0.1.1. A workaround involves moving any policy topics with private groups to restricted categories.

EPSS 0.3%Vulnerabilitydiscourse#cwe-200Germany+6

Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1.

Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malicious actor to cause a Discourse instance to use excessive disk space and also often excessive bandwidth. The issue is patched 3.1.4 and 3.2.0.beta4.

EPSS 0.6%Vulnerability#cwe-400Germany+6

Discourse-reactions is a plugin that allows user to add their reactions to the post. Data about a user's reaction notifications could be exposed. This vulnerability was patched in commit 2c26939.

EPSS 0.3%Vulnerabilitydiscourse#cwe-284Germany+5