CVE-2024-37157

Discourse prior to version 3.2.3 on the stable branch and 3.3.0.beta4 on the beta/tests-passed branches is vulnerable to an SSRF via the FastImage library, which could redirect requests to an internal Discourse IP. The issue is patched in 3.2.3 (stable) and 3.3.0.beta4 (beta/tests-passed). No pub...

BIT-DISCOURSE-2021-43793 Bypass of Poll voting limits in Discourse

Discourse is an open source discussion platform. In affected versions a vulnerability in the Polls feature allowed users to vote multiple times in a single-option poll. The problem is patched in the latest tests-passed, beta and stable versions of Discourse...

CVE-2023-23621

Discourse is an open-source discussion platform. Prior to version 3.0.1 on the stable branch and version 3.1.0.beta2 on the beta and tests-passed branches, a malicious user can cause a regular expression denial of service using a carefully crafted user agent. This issue is patched in version 3.0....

CVE-2021-32788 Post creator of a whisper post can be revealed to non-staff users in Discourse

Discourse is an open source discussion platform. In versions prior to 2.7.7 there are two bugs which led to the post creator of a whisper post being revealed to non-staff users. 1: Staff users that creates a whisper post in a personal message is revealed to non-staff participants of the personal...