CVE-2026-28218
Fail-Open Access Control in Discourse Data Explorer Enables SQL Injection
Publication date: 2026-02-26
Last updated on: 2026-03-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 2025.12.2 (exc) |
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.1 (exc) |
| discourse | discourse | 2026.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Discourse open source discussion platform's Data Explorer plugin. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, there is a fail-open access control issue that allows any authenticated user to execute SQL queries that do not have explicit group assignments, including built-in system queries.
This means that users with basic authentication can run potentially sensitive or unrestricted SQL queries because the plugin does not properly restrict access when group permissions are not explicitly set.
The issue is fixed in versions 2025.12.2, 2026.1.1, and 2026.2.0. Workarounds include explicitly setting group permissions on each Data Explorer query without permissions or disabling the discourse-data-explorer plugin.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing any authenticated user to execute SQL queries without proper access restrictions. This could lead to unauthorized access to sensitive data or system information through the Data Explorer plugin.
Because users can run built-in system queries or other queries without explicit group permissions, it may expose data that should otherwise be restricted, potentially leading to data leakage or unauthorized data manipulation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Discourse to versions 2025.12.2, 2026.1.1, or 2026.2.0 where the issue is patched.
Alternatively, as a workaround, you can either explicitly set group permissions on each Data Explorer query that lacks permissions or disable the discourse-data-explorer plugin entirely.