CVE-2021-3138: Discourse

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms.

Affected products

• Discourse Discourse: up to and including 2.6.0; version 2.7.0 only

Published 2021-01-14. Last modified 2026-06-17.