Discourse's Data Explorer allowed parameterized queries to bypass intended boundaries through recursive interpolation and comment-based injections, enabling attackers to read any database table. The flaw does not allow data modification because queries run in read‑only transactions, but the ability to retrieve arbitrary data poses a significant confidentiality breach. The weakness matches CWE‑89, representing an SQL injection vulnerability.

The vulnerability impacts the Discourse open‑source discussion platform. All releases from 2026.1.0 to and including 2026.1.7, the 2026.6.2 release, the 2026.7.1 release, and the 2026.8.0-latest.1 build are affected. The affected functionality is the Data Explorer plugin, which allows staff or non‑staff members who are part of a group with shared queries to execute queries.

The CVSS score of 7.1 rates the issue as high severity, and the absence of an EPSS value indicates no current exploitation data is reported. The flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw by submitting a crafted parameter to a Data Explorer query that resolves to a parameter declaration or comment, thereby triggering recursive interpolation. Any user with query execution privileges, including non‑staff group members, can obtain sensitive database information. The vulnerability remains active until the affected releases are updated, so patching is advised.