Security readout for executives and security teams
Plain-English summary
CVE-2026-28218 affects Discourse sites using the Data Explorer plugin. A permission failure could let any logged-in user run SQL queries that lack explicit group restrictions, including built-in system queries. The main business risk is unintended data exposure from forum databases. The vendor has patched the issue in listed versions and provided workarounds.
Executive priority
Treat as a timely patching and configuration review item for Discourse environments. It is not described as actively exploited, but it can expose database information to ordinary logged-in users if the plugin and weak query permissions are present.
Technical view
The vulnerability is a fail-open access control issue, classified as CWE-284, in Discourse's Data Explorer plugin. Before 2025.12.2, 2026.1.1, and 2026.2.0, authenticated users could execute Data Explorer SQL queries with no explicit group assignments. CVSS v4.0 is 5.3, with network access, low complexity, low privileges, and low confidentiality impact.
Likely exposure
Exposure is limited to Discourse deployments with the discourse-data-explorer plugin enabled and affected versions installed. Unauthenticated attackers are not indicated; the source requires an authenticated user account. Sites with unpermissioned Data Explorer queries are most relevant.
Exploitation context
The provided sources do not state active exploitation, and the CVE is not listed as KEV in the supplied bundle. Abuse would require a logged-in account and access to Data Explorer queries lacking explicit group permissions. The source does not provide broader exploit evidence.
Researcher notes
Key conditions are authenticated access, the Data Explorer plugin, and queries without explicit group assignments. The advisory states built-in system queries may be included. Evidence supports confidentiality-focused impact only; integrity and availability impact are not indicated by the supplied CVSS vector.
Mitigation direction
- Upgrade Discourse to 2025.12.2, 2026.1.1, 2026.2.0, or later applicable versions.
- Set explicit group permissions on every Data Explorer query without permissions.
- Disable the discourse-data-explorer plugin if it is not required.
- Monitor the GitHub advisory for any updated vendor guidance.
Validation and detection
- Confirm whether the discourse-data-explorer plugin is enabled.
- Check the running Discourse version against the affected and fixed versions.
- Review Data Explorer queries for missing explicit group assignments.
- Verify only intended groups can access each Data Explorer query.
- Review application logs for unusual authenticated Data Explorer activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-28218 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/discourse/discourse/security/advisories/GHSA-jxrc-72mr-mfh5CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.