CVE-2026-72728: Improper Input Validation

Discourse is an open-source discussion platform. Prior to 2026.1.7, an authenticated user could submit specially formed URLs that bypassed the Onebox allowlist and embedded malicious content in a site. This issue is fixed in versions 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1...

CVE-2026-72726: Exposure of Sensitive Information to an Unauthorized Actor

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

CVE-2026-72723: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymousdefaultnavigationmenutags serializes tags from SiteSetting.defaultnavigationmenutags without applying DiscourseTagging.filtervisible for the anonymous viewer. An...

PT-2026-69866

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An authenticated user can eavesdrop on private AI bot conversations by accessing th...

PT-2026-69861

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description Onebox::DomainChecker.is blocked? performs a case-sensitive comparison between...

PT-2026-69871

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.7 Discourse versions 2026.6.0 through 2026.6.2 Discourse versions 2026.7.0 through 2026.7.1 Discourse versions 2026.8.0-latest through 2026.8.0-latest.1 Description Users capable of running...

PT-2026-69868

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.7 Description An authenticated user can submit specially formed URLs to bypass the Onebox allowlist, which allows the embedding of malicious content within a site. Onebox is a feature that expands URLs into...

PT-2026-69862

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An authenticated user can obtain canonicalized slugs or titles of restricted topics...

CVE-2026-72732: Missing Authorization

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discoursetemplates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discoursetemplates/templatesserializer.rb d...

PT-2026-69870

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The Rich Text Editor renders a chat-transcript username as HTML, which enables stor...

PT-2026-69867

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description A low-privileged user can submit crafted content to the moderation review queue. Th...

PT-2026-69869

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description The discourse-local-dates plugin renders crafted local-date format data as HTML. Th...

CVE-2026-72721: Improper Handling of Case Sensitivity

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.isblocked? compares hostnames and SiteSetting.blockedoneboxdomains entries case-sensitively, allowing an attacker to bypass configured Onebox domain restrictions by changing...

PT-2026-69860

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.7 Discourse versions prior to 2026.6.2 Discourse versions prior to 2026.7.1 Discourse versions prior to 2026.8.0-latest.1 Description An HTML injection issue exists in the PrettyText.format for email function...

PT-2026-69863

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An unauthenticated user can retrieve restricted tag names and descriptions through...

Echoes in the Digital Abyss: Examining the Bubble Surrounding Security and Privacy Discourse in Social Networks

The dissemination of security and privacy education and guidance has been and still remains a challenge today. Social networks represent a potential avenue for sharing best practices, and experimentally they have been found to be effective at this task. While this appears promising, in the real...

BIT-DISCOURSE-2026-55424 Discourse: Topic featured link susceptible to stored XSS

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a topic "featured link" was not sufficiently normalized and escaped before being rendered in the topic list, allowing a user who can set a featured link to inject JavaScript when default Content...

BIT-DISCOURSE-2026-53961 Discourse: Forged AWS SNS bounce notifications can disable a targeted user's email (missing TopicArn binding)

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the AWS SES bounce webhook at POST /webhooks/aws verified that SNS messages were signed by Amazon but did not bind them to trusted TopicArn values, allowing any AWS account holder to publish...

BIT-DISCOURSE-2026-49256 Discourse: Hidden tag names leaked via category serializers

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowedtags, allowedtaggroups, or required tag groups could leak to anonymous and unauthorized users through categor...

BIT-DISCOURSE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...