shouldiuse.io

Categories

VERDICT

Discourse Review

Depends

Should I use Discourse?

Ignite Realtime community forum, running on Discourse - discourse.igniterealtime.org

· 5 days ago

Buy Discourse if you run a serious, long-form community forum and can either self-host with disciplined patching or pay for managed plans. Skip it for lightweight Q&A or real-time chat — Flarum or Discord fit those better.

Confidence

Medium. Based on 25+ public sources; many review snippets were truncated, so exact ratings and hosted prices were unverifiable.

Ratings

  • Value for money
  • Ease of useNo usable evidence in sources
  • Feature depth
  • Support qualityNo support quality evidence found
  • Security posture

Pricing

Free (open source)

Self-hosted

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Hosted (discourse.org)Paid; prices not listed in sources

Best for

  • Open-source projects needing searchable forums
  • Large long-form discussion communities
  • Teams with sysadmin skills to self-host
  • Public support and Q&A communities

Not for

  • Small teams wanting a simple Q&A board — overkill
  • Real-time chat needs; use Slack or Discord
  • Non-technical buyers who won't patch regularly
  • Budget buyers needing cheap managed hosting

Gotchas - check before you buy

high

Outdated self-hosted installs were flagged as at risk; patching discipline is mandatory.

high

Frequent 2026 CVEs (XSS, auth bypass, unauthenticated chat) mean recurring urgent upgrades.

medium

Customers publicly asked 'Why is hosting so expensive?'; self-hosting swaps dollars for your ops time.

Pros and cons

Pros

  • Free, open-source with no license required
  • G2 reviewers consistently praise the product
  • Widely adopted: 7,401 companies tracked using it
  • Runs a public HackerOne bug bounty program
  • Trusted for major communities like Mozilla support

Cons

  • Multiple 2026 CVEs: XSS, auth bypass, chat flaws
  • Critical 2021 RCE triggered a CISA alert
  • Self-hosters on outdated installs publicly warned of exploitation
  • Hosted pricing criticized as expensive by customers
  • Self-hosting demands server setup and ongoing maintenance

Sources & method

- 12 sources - Steady 2026 CVE stream (XSS, auth bypass, chat flaws); runs a HackerOne bounty program; self-hosters must patch promptly.

official x3review x2security x3news x4
  • CVE-2026-59830 — Display Name XSS, Cross-site scripting via display names, disclosed Sep 2026.
  • CVE-2026-27454 — Auth Bypass, Authentication bypass vulnerability, disclosed Mar 2026.
  • CVE-2026-44786 — Unauthenticated chat flaw, Unauthenticated real-time chat vulnerability, Jun 2026.
  • CVE-2026-72730 — Platform XSS, Platform XSS vulnerability, Aug 2026.
  • CVE-2021-41163 — Critical RCE, Critical remote code execution; CISA raised an alarm.

Key stats

  • Value for money: 3/5

    Rating

  • Free (open source)

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 3/5. Free self-host; hosted plans drew cost complaints
  • Ease of use. No usable evidence in sources
  • Feature depth: 4/5. Guess: G2 users praise complete feature set
  • Support quality. No support quality evidence found
  • Security posture: 2/5. Multiple 2026 CVEs; bounty program offsets somewhat
  • 68 G2 reviews across Discourse's seller profile
  • $0 Self-host price open source, no license fee
  • $21M Funding raised per PitchBook
  • 7,401 Adoption companies tracked by TheirStack

Pricing

Self-hosted

Free (open source)

  • No license fee
  • You provide hosting and updates

Hosted (discourse.org)

Paid; prices not listed in sources

  • Managed hosting
  • Yearly billing offered

Security

Steady 2026 CVE stream (XSS, auth bypass, chat flaws); runs a HackerOne bounty program; self-hosters must patch promptly.

  • CVE-2026-59830 — Display Name XSSCross-site scripting via display names, disclosed Sep 2026.⁶
  • CVE-2026-27454 — Auth BypassAuthentication bypass vulnerability, disclosed Mar 2026.
  • CVE-2026-44786 — Unauthenticated chat flawUnauthenticated real-time chat vulnerability, Jun 2026.
  • CVE-2026-72730 — Platform XSSPlatform XSS vulnerability, Aug 2026.
  • CVE-2021-41163 — Critical RCECritical remote code execution; CISA raised an alarm.⁷

Companies that use it

  • Mozilla12
  • Ignite Realtime (this community)
Full analysis

Based on 25+ public sources; many review snippets were truncated, so exact ratings and hosted prices were unverifiable.

Powerful open-source forum for serious communities; heavy for small needs, hosted plans pricey, frequent CVEs demand patching.

Methodology

Based on 25+ public sources; many review snippets were truncated, so exact ratings and hosted prices were unverifiable.

Read how a report is made.

Sources

  1. Discourse Reviews 2026 — G2g2.com
    review
  2. Discourse Products — 68 G2 Reviewsg2.com
    review
  3. Do we have to buy a Discourse license? Nometa.discourse.org
    official
  4. Why is hosting so expensive?meta.discourse.org
    official
  5. Discourse CVE list — OpenCVEapp.opencve.io
    security
  6. CVE-2026-59830 Discourse XSS — SentinelOnesentinelone.com
    security
  7. CISA alert on critical Discourse vulnerabilitysecurityweek.com
    news
  8. Discourse self-hoster warning — LiveOverflowfacebook.com
    news
  9. Discourse bounty policy — HackerOnehackerone.com
    security
  10. Discourse funding — PitchBookpitchbook.com
    news
  11. Companies using Discourse — TheirStacktheirstack.com
    news
  12. Mozilla support: Discourse account datasupport.mozilla.org
    official

Add this review to your site

This check for Discourse says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Discourse Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.