CVE-2026-28218: Discourse

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on each Data Explorer query that doesn't have permissions, or disable discourse-data-explorer plugin.

Affected products

• Discourse Discourse: before 2025.12.2 (fixed in 2025.12.2); from 2026.1.0, before 2026.1.1 (fixed in 2026.1.1); version 2026.2.0 only

Published 2026-02-26. Last modified 2026-06-17.