shouldiuse.io

Categories

VERDICT

Discourse Review

Depends

Should I use Discourse?

Skip to main content - discourse.nixos.org

· 1 month ago

Buy it if you run a serious community needing searchable, long-form discussion — NixOS's own forum proves the model. Skip it if you want quick team chat; Discord or Flarum is less work.

Confidence

Medium. Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo evidence in sources reviewed
  • Security posture

Pricing

$0

Free

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Managed hostingNot disclosed in sources reviewed

Best for

  • Open-source project communities
  • Docs-heavy support forums
  • Large developer ecosystems
  • Self-hosters wanting full control

Not for

  • Small teams wanting quick casual chat
  • Anyone unwilling to moderate or administer a forum
  • Real-time-first communities (use Discord)
  • Buyers wanting a set-and-forget, no-admin forum

Gotchas - check before you buy

high

Self-hosting means you own patching; older instances publicly flagged as vulnerable

medium

No obvious cheap hosted tier; users debate cheapest ways to run it

medium

Plugins expand attack surface; a 2025 plugin CVE needed detection guidance

medium

Free plan is real but limited; full power means paid hosting or sysadmin work

Pros and cons

Pros

  • Free plan available straight from Discourse
  • G2 reviewers call it easy to use
  • Highly customizable, open source with plugins
  • Wide adoption: 7,401+ companies tracked
  • Runs a public bug bounty on HackerOne

Cons

  • Recurring CVEs, including a 2026 authentication bypass
  • Unauthenticated chat message access exploit for 3.1.1
  • Backup disclosure flaw via Rails send_file quirk
  • Self-hosters publicly warned about vulnerable older instances
  • Managed hosting costs push buyers hunting cheaper routes

Sources & method

- 11 sources - Actively maintained with a bug bounty, but a steady CVE stream 2024–2026 including auth bypass and unauthenticated chat access.

official x2review x3security x4news x2
  • CVE-2026-27454: Auth bypass, Discourse authentication bypass vulnerability disclosed March 2026.
  • CVE-2024-53991: Backup disclosure, Rails send_file quirk could expose backups; flagged as urgent for self-hosters.
  • Unauthenticated chat access (3.1.1), Exploit for unauthenticated chat message access listed July 2025.
  • CVE-2025-46824: Plugin vulnerability, Plugin vulnerability with public detection guidance, August 2025.

Key stats

  • Value for money: 3/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 3/5. Free self-host option; hosted costs draw complaints
  • Ease of use: 4/5. G2 reviewers call it easy to use
  • Feature depth: 4/5. Official site touts customization; plugin ecosystem exists
  • Support quality. No evidence in sources reviewed
  • Security posture: 3/5. Bug bounty active, but recurring CVEs incl. auth bypass
  • 7,401+ Companies using tracked by TheirStack
  • $21M+ Total funding per PitchBook
  • Yes Free tier official free plan
  • 4 CVEs Security advisories 2024–2026, incl. auth bypass

Pricing

Free

$0

  • Official free plan
  • Real Discourse, free per vendor

Managed hosting

Not disclosed

  • Official pricing page lists hosting plans
  • Third-party hosts (e.g. Elestio, CloudClusters) also sell it

Security

Actively maintained with a bug bounty, but a steady CVE stream 2024–2026 including auth bypass and unauthenticated chat access.

  • CVE-2026-27454: Auth bypassDiscourse authentication bypass vulnerability disclosed March 2026.⁴
  • CVE-2024-53991: Backup disclosureRails send_file quirk could expose backups; flagged as urgent for self-hosters.⁵
  • Unauthenticated chat access (3.1.1)Exploit for unauthenticated chat message access listed July 2025.⁶
  • CVE-2025-46824: Plugin vulnerabilityPlugin vulnerability with public detection guidance, August 2025.

What users say

G2 reviewers describe Discourse as easy to use and simple yet capable, while Hacker News and self-hosting threads show cost and admin-burden gripes.

Alternatives

Compare Discourse with each alternative.

  • Flarum

    Lighter open-source forum; simpler to run than Discourse.

  • Talkyard

    Forum-plus-chat hybrid positioned as a Discourse alternative.

  • BetterMode

    No-code community platform; less technical overhead.

    Discourse vs BetterMode

  • Discord

    Free real-time chat; worse search, zero admin burden.

Companies that use it

  • NixOS
Full analysis

Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Proven open-source forum for real communities (NixOS runs it); heavy and admin-needy for small teams.

Methodology

Based on ~11 usable public sources; several search results were irrelevant 'discourse analysis' pages and were excluded. Pricing figures were not disclosed in the snippets reviewed.

Read how a report is made.

Sources

  1. Discourse Reviews — G2g2.com
    review
  2. Discourse Pricing (official)discourse.org
    official
  3. Discourse Free Plan (official)discourse.org
    official
  4. CVE-2026-27454: Auth Bypass — SentinelOnesentinelone.com
    security
  5. CVE-2024-53991 Backup Disclosure — ProjectDiscoveryprojectdiscovery.io
    security
  6. Discourse 3.1.1 Unauthenticated Chat Access — Exploit-DBexploit-db.com
    security
  7. Discourse Bug Bounty — HackerOnehackerone.com
    security
  8. Companies that use Discourse — TheirStacktheirstack.com
    news
  9. Discourse Funding — PitchBookpitchbook.com
    news
  10. Cheapest way to run Discourse — Metameta.discourse.org
    review
  11. Discourse vs alternatives — Level1Techs communityforum.level1techs.com
    review

Add this review to your site

This check for Discourse says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Discourse Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.