shouldiuse.io

Categories

VERDICT

Should I use Discourse?

Skip to main content - discourse.biologos.org

Depends. Buy if you run a real, ongoing community like BioLogos does and can spare admin time or hosted fees. Skip if you just need a chat or light discussion — Discord/Slack or a simpler hosted tool costs less and needs no upkeep.

Confidence

Medium. Based on 20+ public sources; many review and pricing snippets were truncated, so no rating figures could be verified.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Self-hosted

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Discourse Cloud (hosted)Paid — prices not confirmed in reviewed sources

Best for

  • Ongoing public communities
  • Open-source self-hosters
  • Orgs replacing legacy forums
  • Long-form, searchable discussion

Not for

  • Small teams wanting quick chat — use Discord/Slack
  • Solo operators with no admin time
  • New or low-traffic communities — empty forums look dead
  • Buyers wanting zero-maintenance SaaS without hosted fees

Gotchas - check before you buy

high

Recent CVEs include XSS and auth bypass; patch fast or choose managed hosting

medium

Self-hosting needs real RAM and sysadmin time; budget for upgrades and backups

medium

Admin accounts are prime targets; social-engineering hacks have hit Discourse forums before

Pros and cons

Pros

  • Open-source and free to self-host
  • Backed by $20M Series A; actively developed
  • Runs a public HackerOne bug bounty
  • Top forum software by market share
  • Built for civil, long-form community discussion

Cons

  • Self-hosting is resource-heavy; users seek lighter alternatives
  • Forum maintenance carries ongoing cost and admin burden
  • OpenAI was breached via its Discourse forum and employee auth
  • Joplin's Discourse forum database was breached in 2022

Sources & method

Analyzed 10/04/2026 - 10 sources - Actively maintained with a HackerOne bug bounty, but 254 CVEs tracked and several breaches of Discourse-run forums.

official x1review x4security x4news x1
  • CVE-2026-32619: Auth bypass vulnerability, Discourse auth bypass disclosed April 2026.
  • CVE-2026-27740: Discourse AI LLM XSS, Cross-site scripting in Discourse AI LLM features.
  • CVE-2025-68666: Information disclosure, Discourse information disclosure flaw.
  • OpenAI breach via Discourse forum, Hackers breached OpenAI through its Discourse forum and employee authentication.
  • Joplin forum database breached, Joplin's self-run Discourse forum database was breached in October 2022.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money: 4/5. Free self-host option offsets maintenance cost
  • Ease of use: 2/5. Self-hosting demands RAM, Docker, admin time
  • Feature depth: 4/5. Plugins, AI features, broad integrations
  • Support quality: 3/5. Community support via meta forum; hosted plans exist
  • Security posture: 2/5. 254 CVEs; public breaches of Discourse forums
  • $20M Funding Series A, Pace Capital, 2021
  • Yes Free self-host tier Open-source core
  • 254 Tracked CVEs Per CVE Tools database

Pricing

Self-hosted

Free

  • Open-source core
  • You manage hosting, upgrades, backups

Discourse Cloud (hosted)

Paid — prices not confirmed in reviewed sources

  • Managed hosting
  • Vendor handles upgrades

Security

Actively maintained with a HackerOne bug bounty, but 254 CVEs tracked and several breaches of Discourse-run forums.

  • CVE-2026-32619: Auth bypass vulnerabilityDiscourse auth bypass disclosed April 2026.⁴
  • CVE-2026-27740: Discourse AI LLM XSSCross-site scripting in Discourse AI LLM features.
  • CVE-2025-68666: Information disclosureDiscourse information disclosure flaw.
  • OpenAI breach via Discourse forumHackers breached OpenAI through its Discourse forum and employee authentication.
  • Joplin forum database breachedJoplin's self-run Discourse forum database was breached in October 2022.⁶

What users say

Users praise Discourse as a community-building platform and hackable open-source tool, while critics flag its resource-heavy self-hosting.

“Discourse is hacker friendly”
Reddit, r/outlier_ai

Alternatives

Compare Discourse with each alternative.

  • Higher Logic Vanilla

    Enterprise community suite for large organizations

Companies that use it

  • BioLogos
  • McNeel (Rhino)
  • Joplin⁶
  • Kodular
  • OpenAI
Full analysis

Based on 20+ public sources; many review and pricing snippets were truncated, so no rating figures could be verified.

Serious open-source forum for serious communities; heavy, maintenance-prone overkill for small teams.

Methodology

Based on 20+ public sources; many review and pricing snippets were truncated, so no rating figures could be verified.

Sources

  1. Discourse Announces $20m Series Ameta.discourse.org
    news
  2. Discourse: An Open-Source Platform Supported by Forum Expertshostingadvice.com
    review
  3. Discourse CVEs and Security Vulnerabilitiescve.tools
    security
  4. CVE-2026-32619: Discourse Auth Bypasssentinelone.com
    security
  5. Discourse Bug Bounty Policyhackerone.com
    security
  6. Our Discourse forum database was breached (Joplin)discourse.joplinapp.org
    security
  7. Forum maintenance costmeta.discourse.org
    official
  8. Discourse market share6sense.com
    review
  9. Discourse: Open Source Alternative to Skool, Circleopenalternative.co
    review
  10. Discourse vs Rakletraklet.com
    review

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.