Discourse up to 2026.1.5/2026.5.1/2026.6.0 Private Message Reviewable Visibility information disclosure

Summaryinfo

A vulnerability classified as problematic was found in Discourse up to 2026.1.5/2026.5.1/2026.6.0. Impacted is an unknown function of the component Private Message Reviewable Visibility. Executing a manipulation can lead to information disclosure. This vulnerability is tracked as CVE-2026-84302. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Discourse up to 2026.1.5/2026.5.1/2026.6.0 and classified as problematic. This vulnerability affects an unknown function of the component Private Message Reviewable Visibility. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-84302 since 09/01/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 2026.1.6, 2026.5.2, 2026.6.1 or 2026.7.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 2026.0
• 2026.1
• 2026.1.0
• 2026.1.1
• 2026.1.2
• 2026.1.3
• 2026.1.4
• 2026.1.5
• 2026.2
• 2026.3
• 2026.4
• 2026.5
• 2026.5.0
• 2026.5.1
• 2026.6.0

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion