PT-2026-26371 · Discourse · Discourse

Davidtaylorhq · Published 2026-03-19 · Updated 2026-03-27 · CVE-2026-27935

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a flaw in an API endpoint. This endpoint allows the disclosure of private topic metadata belonging to administrator users to moderator users, even when those moderators do not have authorized access to the private topics. The affected API endpoint exposes sensitive information.

Recommendations Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BIT-DISCOURSE-2026-27935

CVE-2026-27935

GHSA-WXQR-R4WV-CW76

Affected Products

Discourse

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27935.json · Exploit
• https://github.com/discourse/discourse/commit/d8dbb4cb189cded8c9e8b3ada859fc0db3f41897 · Patch
• https://github.com/discourse/discourse/commit/c0f6e9a903800de0dda65c114418ae703d8a51fc · Patch
• https://github.com/discourse/discourse/commit/f37e4fdf8391e4a54f1885a3a5514d390eb28bab · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-wxqr-r4wv-cw76 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27935 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-27935 · Vendor Advisory
• https://twitter.com/dailycve/status/2036274789036212391 · Twitter Post
• https://twitter.com/CVEnew/status/2034891628402331784 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034892998886986172 · Twitter Post