Discourse Data Explorer Plugin Fail-Open Access Control Vulnerability Allowing Unauthorized SQL Query Execution

A fail-open access control vulnerability has been identified in the Data Explorer plugin for Discourse, an open-source discussion platform. This issue affects all versions prior to 2025.12.2, 2026.1.1, and 2026.2.0. The vulnerability allows any authenticated user to execute SQL queries without explicit group assignments, including built-in system queries. Exploitation of this vulnerability is possible for any authenticated user, as there are no special requirements or conditions needed.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of SQL queries, potentially allowing access to sensitive data or manipulation of the database.

Remediation

Users can upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0 to address this vulnerability. Alternatively, group permissions can be explicitly set on each Data Explorer query lacking them, or the Data Explorer plugin can be disabled.