https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T06:27:52.330885+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-discourse-2026-44785 BIT-discourse-2026-44785 — Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts 2026-10-13T06:27:52.334480+00:00

Affected: Bitnami: discourse

Discourse is an open-source discussion platform. From versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking "Explain" on a reply to it. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-327339 EUVD-2026-327339 2026-10-13T06:27:52.334577+00:00 EUVD-2026-327339 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44785 fkie_cve-2026-44785 2026-10-13T06:27:52.334602+00:00

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking "Explain" on a reply to it. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.