Arbitrary `/tmp` read in discourse via `convert_heif!` decoder-confusion (regression of 4bf3bf6786) #3738834 Valid Information Disclosure Medium 2026-10-26 – 4 Users can bookmark other user's messages #192611 Valid Access Control – 2017-01-10 – 7 Stored XSS in topics because of whitelisted_generic engine vulnerability #197902 Valid Cross-site Scripting – 2017-01-20 – 13 Stored XSS in posts because of absence of oembed variables values escaping #197914 Valid Cross-site Scripting – 2017-01-20 – 13 XSS Vulnerability on Image link parser #191909 Valid Cross-site Scripting – 2017-01-10 $256 15 XSS vulnerability on Audio and Video parsers #192223 Valid Cross-site Scripting – 2017-01-10 $256 15 XSS in topics because of bandcamp preview engine vulnerability #197443 Valid Cross-site Scripting – 2017-01-20 – 15 Any authenticated user can download full list of users, including email #228399 Valid Information Disclosure – 2017-06-17 $256 19 Gaining access to private topics using quoting feature #312647 Valid Access Control – 2018-03-17 $256 19 Stored XSS in "post last edited" option #333507 Valid Cross-site Scripting – 2018-07-09 $256 19 DOM Based XSS in Discourse Search #191890 Valid Cross-site Scripting – 2017-01-10 – 29 Hidden/restricted tags can be mutated through synonym ID paths without per-tag authorization #3689633 Valid Insecure Direct Object Reference Medium 2026-08-26 – 31 SSRF in upload IMG through URL #228377 Valid Information Disclosure – 2017-06-18 $64 32 Admin Command Injection via username in user_archive ExportCsvFile #214022 Valid Command and Code Injection – 2017-05-13 $512 45 Web Cache Deception Attack (XSS) #394016 Valid Cross-site Scripting – 2018-11-18 $256 51 Arbitrary Local-File Read from Admin - Restore From Backup due to Symlinks #213558 Valid Information Disclosure – 2017-05-13 $512 52 CSRF-tokens on pages without no-cache headers, resulting in ATO when using CloudFlare proxy (Web Cache Deception) #260697 Valid Cross-Site Request Forgery – 2018-08-08 – 58 Any user with invite capabilities can take-over any account on Discourse #242765 Valid No weakness recorded – 2017-11-06 $1,024 75 Application Level DoS - Large Markdown Payload in Reply Section Leading to Resource Exhaustion #3058919 Valid Denial of Service High 2025-10-18 – 84 Account takeover at https://try.discourse.org due to no CSRF protection in connecting Yahoo account #423022 Valid Cross-Site Request Forgery – 2018-12-06 – 89 Denial of Service (DoS) Vulnerability in Drafts Creation Endpoint #3400140 Valid Denial of Service High 2026-06-30 $1,024 98