PT-2026-26543 · Discourse · Discourse

Jomaxro · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-31869

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. The ComposerController#mentions API endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user reasons returns "private" for a given user. This bypasses group member-visibility controls.

Recommendations Restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.

Exploit

Fix

Improper Authorization

Information Disclosure

IDOR

Weakness Enumeration

CWE-285

CWE-200

CWE-639

Related Identifiers

BIT-DISCOURSE-2026-31869

CVE-2026-31869

GHSA-5F9H-VP7V-7VQ5

Affected Products

Discourse

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31869.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-31869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31869 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31869 · Vendor Advisory
• https://twitter.com/CVEnew/status/2034841424693456976 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034900443206189326 · Twitter Post