CVE-2026-55704 in Discourse
Summary
by MITRE • 08/17/2026
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
Discourse is a widely deployed open-source discussion platform that facilitates community engagement through threaded conversations, group-based interactions, and collaborative content creation features such as shared drafts. Shared drafts are designed to allow multiple users within a specific group or topic to collaboratively compose posts before final publication, ensuring that the content remains private until explicitly published by an authorized user. This functionality relies on strict access control mechanisms to prevent unauthorized parties from viewing draft content, which may contain sensitive information, preliminary ideas, or confidential discussions intended only for the drafting participants. The integrity of this feature is critical for maintaining trust among users who rely on Discourse for professional and private communications where confidentiality is paramount.
A significant vulnerability was identified in versions of Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, characterized by an improper access control flaw within the group posts and group mentions API endpoints. The technical root cause lies in a failure to properly validate user permissions when retrieving shared draft entries associated with a specific group or topic. Specifically, while the application correctly restricted direct viewing of shared drafts through standard interfaces, it failed to apply equivalent restrictions at the backend endpoint level responsible for listing activity related to groups and mentions. This discrepancy allowed any authenticated user who possessed basic privileges to view general group activity logs to inadvertently access entries containing unpublished draft materials. The vulnerability effectively bypasses the intended isolation between public or semi-public group activities and private drafting workflows, creating a side-channel through which sensitive data can be exfiltrated without explicit permission grants for draft viewing.
The operational impact of this information disclosure is substantial, particularly in environments where shared drafts are used for collaborative work involving proprietary business strategies, legal documents, or personal confidential communications. An attacker with low-level access privileges could enumerate group activities and extract topic titles along with post excerpts or full content from unpublished drafts. This exposure not only compromises the confidentiality of individual users but also undermines the security posture of organizations using Discourse as a primary communication tool. The disclosure of draft content can lead to competitive disadvantage, reputational damage, or violation of data protection regulations if personal identifiable information is included in the leaked material. Furthermore, because the vulnerability affects API endpoints often used by automated tools and integrations, it may be exploited at scale without triggering typical manual audit alerts associated with direct page visits.
This flaw aligns with CWE-284 Improper Access Control, as the application failed to enforce proper authorization checks on a critical data retrieval function. It also maps to MITRE ATT&CK technique T1005 Data from Local System Retrieval, specifically through API endpoints that allow unauthorized actors to gather sensitive information stored within the system's database structures. The vulnerability highlights the importance of consistent security enforcement across all interfaces and backend services, ensuring that permission checks are applied uniformly regardless of whether access is initiated via a web interface or an application programming interface.
To mitigate this risk, organizations running affected versions must upgrade immediately to Discourse version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, where the access control logic has been corrected to properly restrict draft visibility based on user permissions across all endpoints. Administrators should also review their group configurations and ensure that shared drafts are only utilized by trusted members who require such functionality. Regular security audits of API endpoint behaviors can help identify similar discrepancies in other parts of the application stack, reinforcing a defense-in-depth strategy against information disclosure vulnerabilities.