Exposure of Information in Discourse Open-Source Discussion Platform
CVE-2026-27934

8.7HIGH

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
19 March 2026

What is CVE-2026-27934?

Discourse, the popular open-source discussion platform, is impacted by a flaw that allows unauthorized users to access sensitive information, specifically the title and excerpt of posts through a user action API endpoint. This issue arises due to insufficient visibility checks, which could compromise user data and lead to potential data leaks. Users are advised to update to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2, which contain necessary patches to mitigate this vulnerability. Unfortunately, there are no known workarounds available.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.2 < 2026.1.0-latest, 2026.1.2

discourse >= 2026.2.0-latest, < 2026.2.1 < 2026.2.0-latest, 2026.2.1

discourse = 2026.3.0-latest = 2026.3.0-latest

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.