Jomaxr

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 **Description** Discourse is an open-source discussion platform. A moderator could exploit insufficient authorization checks to access metadata of posts they should not have permission to view. The issue involves inadequate restrictions on access to post metadata. **Recommendations** Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 **Description** Discourse is an open-source discussion platform. Before versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an Insecure Direct Object Reference (IDOR) exists, allowing any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics that are not intended to be public. The attack is conducted over the network, requiring low privileges (any logged-in user), and results in a low impact on confidentiality. **Recommendations** Versions prior to 2026.3.0-latest.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.2.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.1.2: Disable the AI plugin or upgrade to a patched version.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 **Description** Discourse is an open-source discussion platform. An authorization bypass issue in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. The vulnerability relates to bypassing intended access restrictions. **Recommendations** Update to Discourse version 2026.3.0-latest.1 or later. Update to Discourse version 2026.2.1 or later. Update to Discourse version 2026.1.2 or later. As a workaround, ensure only trusted users are part of the Site Setting for `accept all solutions allowed groups`.

**Name of the Vulnerable Software and Affected Versions** Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2 **Description** Discourse is an open-source discussion platform. Moderators can create Zendesk tickets for topics they do not have access to view in versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. This impacts all forums utilizing the Zendesk plugin. **Recommendations** Update to Discourse version 2026.3.0-latest.1. Update to Discourse version 2026.2.1. Update to Discourse version 2026.1.2.