CVE-2026-27149

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, SQL injection in PM tag filtering (`list_private_messages_tag`) allows bypassing tag filter conditions, potentially disclosing unauthorized private message metadata. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

• CWE-89

• https://github.com/discourse/discourse/security/advisories/GHSA-m6qf-h49w-h38wVendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27143Arithmetic over induction variables in loops were not correc…9.8
• CVE-2026-27144The compiler is meant to unwrap pointers which are the opera…7.1
• CVE-2026-27145(*x509.Certificate).VerifyHostname previously called matchHo…6.5
• CVE-2026-27146GetSimple CMS is a content management system. All versions o…4.5
• CVE-2026-27147GetSimple CMS is a content management system. All versions o…5.4
• CVE-2026-27148Storybook is a frontend workshop for building user interface…9.6
• CVE-2026-27150Discourse is an open source discussion platform. Prior to ve…3.8
• CVE-2026-27151Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-27152Discourse is an open source discussion platform. Prior to ve…3.8
• CVE-2026-27153Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-27154Discourse is an open source discussion platform. Prior to ve…6.1
• CVE-2026-27156NiceGUI is a Python-based UI framework. Prior to version 3.8…6.1