Suggestions search

All statuses

Filter by:

With package: discourse

Found 112 matching suggestions

View:

Compact

Detailed

Published

Permalink CVE-2026-27151

updated 5 months, 4 weeks ago by @LeSuisse Activity log

Created suggestion 5 months, 4 weeks ago
@LeSuisse ignored
5 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- python314Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
5 months, 4 weeks ago
@LeSuisse accepted 5 months, 4 weeks ago
@LeSuisse published on GitHub 5 months, 4 weeks ago

Discourse doesn't validate destination topic when moving posts

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

References

https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw x_refsource_CONFIRM

Affected products

discourse

==>= 2026.1.0-latest, < 2026.1.1
==< 2025.12.2
==>= 2026.2.0-latest, < 2026.2.0

Matching in nixpkgs

pkgs.discourse

Open source discussion platform

nixos-unstable 2025.12.1
- nixpkgs-unstable 2025.12.1
- nixos-unstable-small 2025.12.1

pkgs.discourseAllPlugins

Open source discussion platform

nixos-unstable 2025.12.1
- nixpkgs-unstable 2025.12.1
- nixos-unstable-small 2025.12.1

Ignored packages (5)

pkgs.discourse-mail-receiver

Helper program which receives incoming mail for Discourse

nixos-unstable 4.1.0
- nixpkgs-unstable 4.1.0
- nixos-unstable-small 4.1.0

pkgs.python312Packages.pydiscourse

None

pkgs.python313Packages.pydiscourse

Python library for working with Discourse

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0

pkgs.python314Packages.pydiscourse

Python library for working with Discourse

nixos-unstable 1.7.0
- nixpkgs-unstable 1.7.0
- nixos-unstable-small 1.7.0

pkgs.grafanaPlugins.grafana-discourse-datasource

Allows users to search and view topics, posts, users, tags, categories, and reports on a given Discourse forum through Grafana

nixos-unstable 2.0.2
- nixpkgs-unstable 2.0.2
- nixos-unstable-small 2.0.2

Package maintainers

@talyz Kim Lindberger <kim.lindberger@gmail.com>

Upstream advisory: https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw

Untriaged

Permalink CVE-2025-67723

4.6 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): Low (L)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): Low (L)
Modified Availability (MA): Low (L)

updated 6 months, 2 weeks ago by @jopejoe1 Activity log

Created suggestion 6 months, 3 weeks ago
@jopejoe1 ignored
4 packages
- discourse-mail-receiver
- python312Packages.pydiscourse
- python313Packages.pydiscourse
- grafanaPlugins.grafana-discourse-datasource
6 months, 2 weeks ago

Discourse vulnerable to stored Cross-site Scripting via Katex in discourse-math plugin

Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-site scriptinv vulnerability on the Discourse Math plugin when using its KaTeX variant. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, the Discourse Math plugin can be disabled, or the Mathjax provider can be used instead of KaTeX.