Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:37:39 +0000 BIT-discourse-2026-33428 — Discourse Allows Unauthorized Access to Deleted Posts Index via Group Membership https://cve.radiocsirt.org/vuln/bit-discourse-2026-33428 <p><strong>Affected:</strong> Bitnami: discourse</p> <p>Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.</p> <p><strong>Affected:</strong> Bitnami: discourse</p> <p>Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/bit-discourse-2026-33428 cnvd-2026-17481 https://cve.radiocsirt.org/vuln/cnvd-2026-17481 cnvd-2026-17481 https://cve.radiocsirt.org/vuln/cnvd-2026-17481 EUVD-2026-277354 https://cve.radiocsirt.org/vuln/euvd-2026-277354 EUVD-2026-277354 https://cve.radiocsirt.org/vuln/euvd-2026-277354 fkie_cve-2026-33428 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33428 <p>Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.</p> <p>Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33428