CVE-2026-27152Disclosure(discourse / discourse)

LOWCVSS 3.8 · LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them to an existing DM channel, bypassing per-recipient PM restrictions that are enforced during DM channel creation. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

discourse CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/discourse/discourse/security/advisories/GHSA-f8ff-pxg3-7967

Weakness type (CWE)

CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

discourse

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
General: 1 classified signal
3 total mentions across 1 day

Affected systems

Vendors

discourse

Products

discourse

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud223d
Disclosure
🚨*CVE* CVE-2026-27152 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat… https://www.cve.org/CVERecord?id=CVE-2026-27152 ----- Traducción: CVE-2026-27152 Dis… http://infoflow.cloud`
Post summary
CVE-2026-27152 is a disclosed vulnerability in Discourse allowing a DM communication‑preference bypass when adding members via Chat, as referenced on cve.org.
0000034
55 followersView on X
CVE@CVEnew223d
Disclosure
CVE-2026-27152 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat… https://www.cve.org/CVERecord?id=CVE-2026-27152
Post summary
The post announces a DM communication‑preference bypass vulnerability in Discourse (CVE‑2026‑27152) affecting certain versions, without any exploit code, patch, or evidence of active exploitation.
00000242
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds223d
General
CVE-2026-27152 Communication Preference Bypass in Discourse DM Channel C... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27152 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The tweet simply announces CVE‑2026‑27152 with a brief description and a link to more information, without any details on exploitation, patching, or technical specifics.
0000040
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	discourse	discourse	-	-	-
App	discourse	discourse	2026.2.0	-	-

Explore more

Back to dashboard discourse CVEs discourse vulnerabilities