SB20261111194 - Multiple vulnerabilities in Discourse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261111194

SB20261111194 - Multiple vulnerabilities in Discourse

Published: November 11, 2026 Updated: November 13, 2026

Security Bulletin ID SB20261111194
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 19
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 11% Low 89%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 19 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to inject misleading links, images, or styling into personal message notification emails.

The vulnerability exists due to improper neutralization of HTML and Markdown in Discourse email generation when rendering participant names or topic titles. A remote user can supply crafted group full names for groups invited to personal messages, user full names when prioritize_username_in_ux is disabled, or topic titles when customized email headers, footers, or preview texts include %{topic_title} to alter emails received by other participants.


2) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to copy or delete S3 files outside the temporary upload folder, including files belonging to other sites sharing the bucket.

The vulnerability exists due to authorization bypass through user-controlled keys in Discourse external upload records when restoring backups on sites using direct S3 uploads with allow_restore enabled. A remote privileged user can restore a crafted backup containing external upload records referencing files outside the temporary upload folder to cause unauthorized file copying or deletion.


3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote privileged user to read arbitrary URLs from the server and potentially disclose sensitive information.

The vulnerability exists due to server-side request forgery in Discourse's animated GIF detection job when processing upload records restored from a crafted backup on sites with allow_restore enabled. A remote privileged user can supply a backup containing crafted upload records to bypass the usual SSRF protections and access resources outside the upload store.


4) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to execute arbitrary shell commands on the Discourse host.

The vulnerability exists due to improper neutralization of shell command elements in the Discourse uploads:gather rake task when processing upload records restored from a crafted backup. A remote privileged user can supply a backup containing malicious upload records to execute shell commands when a system administrator restores the backup and runs the task.


5) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read arbitrary server files, including configuration files.

The vulnerability exists due to path traversal in Discourse's S3 upload migration when processing restored backup upload filenames containing newlines. A remote privileged user can restore a crafted backup on an S3-enabled site with allow_restore enabled to cause files outside the uploads directory to be uploaded to the bucket, exposing their contents.


6) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: N/A)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to gain administrator privileges and disclose server secrets or other users' data.

The vulnerability exists due to improper neutralization of template elements in Discourse Automation when enabled automations insert user-written text through %%KEY%% or %%REPORT=…%% placeholders and evaluate embedded template tags server-side. A remote user can craft topic titles, posts, profile fields, or report-listed text containing template tags to gain administrator privileges or read sensitive information.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to alter notification email appearance or disguise links through injected HTML attributes.

The vulnerability exists due to improper neutralization of post content in Discourse notification email rendering when constructing links from iframe URLs and embedding secure images using supplied dimensions. A remote user can craft posts containing iframe URLs whose origins are permitted by allowed_iframes, or secure images when secure_uploads_allow_embed_images_in_emails is enabled, to inject HTML attributes into emails received by other users.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to inject arbitrary HTML into posts.

The vulnerability exists due to unsafe reparsing of sanitized HTML in Discourse's code-block highlighting component when highlighting Unicode bidirectional characters with Nokogiri 1.19.4 or earlier. A remote user can craft a post containing bidirectional characters in attribute values that become HTML during reparsing to bypass sanitization and inject arbitrary markup.


9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to spoof content or overlay parts of the page with injected HTML.

The vulnerability exists due to improper neutralization of HTML in Discourse's Chat plugin when wildcard-based watched-word censoring rewrites quoted chat messages after sanitization. A remote user can craft a chat transcript on sites with the Chat plugin enabled and wildcard-containing censored watched words to inject HTML attributes and elements that bypass sanitization.


10) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to inject persistent HTML into posts and display fake content to viewers.

The vulnerability exists due to improper output escaping in Discourse onebox renderers when embedding external page metadata or site-specific titles and text, although scripts are still removed. A remote user can post a link to controlled content containing crafted metadata, titles, or text to inject styled HTML into the stored onebox and obscure the page with fake content.


11) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to download secure uploads belonging to another site in a Discourse multisite cluster.

The vulnerability exists due to authorization bypass through a user-controlled key in secure upload signing when multisite sites share one S3 bucket. A remote privileged user can obtain signed access to another site's secure uploads to disclose sensitive information across site boundaries.


12) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read new messages from restricted category chat channels without permission to join them or read their history.

The vulnerability exists due to incorrect authorization in Discourse MessageBus when delivering chat messages for restricted categories. A remote user can receive messages in real time through membership in a group with only "See" permission, without "Reply" or "Create" permission, to access otherwise unauthorized chat content.


13) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read content from posts hidden by community flags or staff action without permission.

The vulnerability exists due to improper access control in Discourse’s RSS feeds, HTML descriptions, social metadata, and digest emails when generating content from hidden posts. A remote attacker can request a topic’s RSS feed to read a hidden first post’s full raw body, request topic pages to obtain hidden post excerpts through metadata, or receive digest emails containing excerpts from hidden replies selected as highest-scored posts to disclose restricted content.


14) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over accessible user accounts and potentially gain full administrator access.

The vulnerability exists due to improper authorization in Discourse user-update and user-creation endpoints when processing external_ids from administrator-authenticated scoped API keys. A remote user can use a scoped key and applicable external login provider to bind a target account to a controlled identity through users:update, enabling account takeover, or reassign an existing managed-provider association through users:create, compromising that association.


15) Race condition (CVE-ID: N/A)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to claim account privileges associated with an email address they do not own.

The vulnerability exists due to a race condition in Discourse's email-code activation flow when passwordless login or email-code activation is enabled. A remote attacker can exploit an email address swap during activation to gain privileges associated with another email address.


16) UNIX symbolic link following (CVE-ID: N/A)

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read and write files outside the restore directory as the user running Discourse, potentially executing code on the server.

The vulnerability exists due to symbolic link following in the Discourse backup restore functionality when restoring uploaded archives with allow_restore enabled. A remote privileged user can restore a crafted backup containing symbolic links to access files outside the restore directory.


17) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to read or overwrite files outside the uploads directory, including server configuration files.

The vulnerability exists due to path traversal in Discourse's restored upload records when processing backups on sites with allow_restore enabled. A remote privileged user can restore a crafted backup containing upload paths outside the uploads directory to cause Discourse to read or write files elsewhere on the server.


18) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to write files outside the temporary directory used for custom emoji export.

The vulnerability exists due to improper pathname restriction in Discourse's custom emoji export when processing emoji names restored from a crafted backup. A remote privileged user can restore a backup containing crafted emoji names on a site with allow_restore enabled and trigger emoji export to write files outside its intended directory.


19) Exposure of Resource to Wrong Sphere (CVE-ID: N/A)

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

CVSSv4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to make another site in a Discourse multisite cluster serve attacker-controlled content, including theme JavaScript.

The vulnerability exists due to exposure of resources across site boundaries in Discourse disk caches when multiple sites share a multisite cluster. A remote privileged user can use administrative control of one site to influence shared cached content and cause another site to serve that content.


Remediation

Install update from vendor's website.

References