Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure

Discourse 2026.1.2/2026.2.1/2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges. id: CVE-2026-27934 info: name:...

CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 are vulnerable to an authentication bypass in the response-action API endpoints . This flaw occurs when AISOC_DEV_MODE is enabled and the AISOC_ACTIONS_SERVICE_TOKEN is empty within a default Docker Compose deployment. An unauthenticated attacker can exploit thi...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

EUVD-2026-89537

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053 AiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

CVE-2026-103053: Missing Authentication for Critical Function

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOCDEVMODE is enabled and AISOCACTIONSSERVICETOKEN is empty in the default Docker Compose deployment. Unauthenticated attackers can list response-action integrations, submit and approve...

PT-2026-102963

Name of the Vulnerable Software and Affected Versions AiSOC versions 9.0.0 through 11.9.9 Description Authentication is not enforced on the response-action API endpoints when AISOC DEV MODE is enabled and AISOC ACTIONS SERVICE TOKEN is empty within the default Docker Compose deployment. This allo...

com.powsybl:powsybl-action-api (6.3.0-alpha-1), com.powsybl:powsybl-action-ial-dsl (6.3.0-alpha-1) +44 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.3.0-alpha-1)

com.powsybl:powsybl-computation-local MAVEN version 6.3.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.3.0-alpha-1 -...

com.powsybl:powsybl-action-api (6.4.0-rc2), com.powsybl:powsybl-action-ial-dsl (6.4.0-rc2) +52 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.4.0-rc2)

com.powsybl:powsybl-computation-local MAVEN version 6.4.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.4.0-rc2 - com.powsybl:powsybl-action-ial-dsl...

com.powsybl:powsybl-action-api (6.6.0-rc1), com.powsybl:powsybl-action-ial-dsl (6.6.0-rc1) +46 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.6.0-rc1)

com.powsybl:powsybl-computation-local MAVEN version 6.6.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.6.0-rc1 - com.powsybl:powsybl-action-ial-dsl...

com.powsybl:powsybl-action-api (6.7.0-rc1), com.powsybl:powsybl-action-ial-dsl (6.7.0-rc1) +47 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.7.0-rc1)

com.powsybl:powsybl-computation-local MAVEN version 6.7.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.7.0-rc1 - com.powsybl:powsybl-action-ial-dsl...

com.powsybl:powsybl-action-api (6.7.1), com.powsybl:powsybl-action-ial-dsl (6.7.1) +66 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.7.1)

com.powsybl:powsybl-computation-local MAVEN version 6.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.7.1 - com.powsybl:powsybl-action-ial-dsl 6.7.1 -...

com.powsybl:powsybl-action-api (6.8.0-rc2), com.powsybl:powsybl-action-ial-dsl (6.8.0-rc2) +47 more potentially affected by CVE-2026-55673 via com.powsybl:powsybl-computation-local (6.8.0-rc2)

com.powsybl:powsybl-computation-local MAVEN version 6.8.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on com.powsybl:powsybl-computation-local and may be impacted: - com.powsybl:powsybl-action-api 6.8.0-rc2 - com.powsybl:powsybl-action-ial-dsl...

CVE-2026-27934

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...

CVE-2026-27934

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...

CVE-2026-27934 Discourse leaks private topic title and post excerpt via user action API endpoint

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions...

CVE-2026-27934

Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 expose topic titles and post excerpts through a user action API endpoint to unauthorized users due to missing visibility checks. The issue enables information disclosure with a CVSS 4.0 base score of 8.7 (HIGH) and no user inte...