What is the CVSS score of EUVD-2026-13245?

EUVD-2026-13245 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-13245?

Within 24 hours: Identify all Discourse instances in your environment and document current versions. Within 7 days: Apply the latest vendor-released patch to all Discourse deployments, beginning with production instances, and verify patch installation through version confirmation commands. Within 30 days: Conduct post-patch validation, review access logs for suspicious activity during the vulnerability window, and implement a change management process to prevent future patching delays.

Discourse EUVD-2026-13245

Q: Which versions of Discourse are affected by EUVD-2026-13245?

CVE-2026-29072 is a remote code execution vulnerability affecting Discourse with a CVSS score of 7.5, enabling attackers to execute arbitrary code on affected instances.. A patch is available.

| CVE-2026-29072 HIGH

Missing Authorization (CWE-862)

2026-03-19 GitHub_M

Authentication Bypass Discourse

7.5

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Unauthenticated user accesses Discourse post creation
Delivery

Craft post with policy acceptance widget markup
Exploit

Bypass policy group validation checks
Execution

Inject functional widget into post content
Impact

Unauthorized policy acceptance widget deployed to users

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 with the discourse-policy plugin enabled (policy_enabled site setting active). Remote unauthenticated attacker can create policy acceptance widgets in posts. No victim interaction needed.
Impact	CVSS 7.5. EPSS 0.0%. No patch confirmed.
Exploit ScenarioDerived	An attacker could exploit this vulnerability in Discourse to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 19, 2026

A remote code execution vulnerability in Discourse (CVSS 7.5). High severity vulnerability requiring prompt remediation.

Earlier versions of this analysis (1)

v1 Mar 19, 2026 - 22:00 CVSS 7.5

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

discourse 2026.1.0-latest, < 2026.1.2

discourse = 2026.3.0-latest

discourse 2026.2.0-latest, < 2026.2.1

Affected Packages

euvd discourse no fix

euvd discourse_2026_1_0_latest fix: 2026.1.2

euvd discourse_2026_2_0_latest fix: 2026.2.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-862 (Missing Authorization). CVSS 7.5 indicates high severity. Affects Discourse.

Know when Discourse gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive summary

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.2,2026.2.1

CVE Published

Mar 19, 2026 - 21:49 nvd

HIGH 7.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users who do not belong to the allowed policy creation groups can create functional policy acceptance widgets in posts under the right conditions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable the discourse-policy plugin by disabling the policy_enabled site setting.

Executive ViewAI

Why It Matters

CVE-2026-29072 is a remote code execution vulnerability affecting Discourse with a CVSS score of 7.5, enabling attackers to execute arbitrary code on affected instances. Organizations running Discourse without current patches face direct risk of system compromise, data breach, and operational disruption. Immediate patching is required to prevent unauthorized access to discussion platforms and associated user data.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 98% exploitable

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Discourse

View all

CVE-2025-48954 HIGH Act Now POC

8.1 Jun 25

Discourse versions prior to 3.5.0.beta6 contain a reflected cross-site scripting (XSS) vulnerability in social login fun

CVE-2022-46162 CRITICAL Act Now POC

9.8 Nov 30

discourse-bbcode is the official BBCode plugin for Discourse. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2026-27934 HIGH This Week POC

8.7 Mar 19

Unauthorized information disclosure in Discourse discussion platform versions prior to 2026.3.0-latest.1, 2026.2.1, and

CVE-2024-47773 HIGH This Week POC

8.2 Oct 08

Discourse is an open source platform for community discussion. Rated high severity (CVSS 8.2), this vulnerability is rem

CVE-2026-26265 HIGH This Week POC

7.5 Feb 26

Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain an insecure direct object reference (IDOR) in the

CVE-2021-3138 HIGH This Week POC

7.5 Jan 14

In Discourse 2.7.0 through beta1, a rate-limit bypass leads to a bypass of the 2FA requirement for certain forms. Rated

CVE-2026-26077 MEDIUM This Month POC

6.5 Feb 26

Unauthenticated attackers can submit forged webhook payloads to multiple email provider integrations in Discourse versio

CVE-2023-38706 MEDIUM This Month POC

6.5 Sep 15

Discourse is an open-source discussion platform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploi

CVE-2024-53991 MEDIUM This Month POC

5.9 Dec 19

Discourse is an open source platform for community discussion. Rated medium severity (CVSS 5.9), this vulnerability is r

CVE-2025-48877 CRITICAL Act Now

9.8 Jun 09

Discourse versions prior to 3.4.4 (stable), 3.5.0.beta5 (beta), and 3.5.0.beta6-dev (tests-passed) contain a critical vu

CVE-2023-47121 CRITICAL Act Now

9.8 Nov 10

Discourse is an open source platform for community discussion. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2022-39355 CRITICAL Act Now

9.8 Oct 26

Discourse Patreon enables syncronization between Discourse Groups and Patreon rewards. Rated critical severity (CVSS 9.8

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2025-20362 HIGH POC

8.6

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2020-36719 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://vuldb.com/?id.351978 REF https://github.com/discourse/discourse/security/advisories/GHSA-7ph8-vprq-4jrp

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back