Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any authenticated user to execute SQL queries that have no explicit group assignments, including built-in system queries. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. As a workaround, either explicitly set group permissions on each Data Explorer query that doesn't have permissions, or disable discourse-data-explorer plugin.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-28218 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, fail-open access control in Data Explorer plugin allows any auth… https://www.cve.org/CVERecord?id=CVE-2026-28218
Post summary
The text announces a fail‑open access control vulnerability (CVE-2026-28218) in Discourse's Data Explorer plugin, affecting versions prior to 2025.12.2, 2026.1.1, and 2026.2.0.
CVE-2026-28218 SQL Query Access Control Vulnerability in Discourse Data Explorer Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28218
Post summary
The post announces CVE-2026-28218 as an SQL query access control vulnerability in the Discourse Data Explorer Plugin, but provides only minimal technical details and no information on PoC, exploitation, or patch availability.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.2.0 | - | - |