CVE-2026-27149 — Discourse has SQL injection in PM tag filtering

CVE-2026-27149

Discourse has SQL injection in PM tag filtering PUBLISHED

Description (CNA)

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected < 2025.12.2; affected >= 2026.1.0-latest, < 2026.1.1; affected >= 2026.2.0-latest, < 2026.2.0

CWE

CWE-89

References

https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38w

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.