Discourse’s Data Explorer plugin previously did not enforce group permissions on certain queries, allowing any authenticated user to run arbitrary SQL statements. This Access Control flaw, classified as CWE‑284, could let an attacker read or modify sensitive database content, potentially exposing private data or compromising the application. The vulnerability is mitigated by restricting queries to approved groups or disabling the plugin.

Discourse products running any version before 2025.12.2, 2026.1.1, or 2026.2.0 are susceptible. The patched releases address the fail‑open access control issue. All Discourse installations that rely on the Data Explorer plugin and have not upgraded to one of these fixed versions are at risk.

This vulnerability has a CVSS score of 5.3, indicating moderate risk. EPSS is below 1%, meaning exploitation is unlikely at this time, and it is not listed in the CISA KEV catalog. An attacker would need only authenticated access and the Data Explorer plugin enabled; no special privileges beyond those required to perform normal user tasks are necessary. Given the low exploitation probability, organizations should still monitor for any suspicious query activity and act promptly when a patch becomes available.