PT-2026-26543 · Discourse · Discourse

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-31869

Mitre

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.

Fix

IDOR

Improper Authorization

Information Disclosure

Weakness Enumeration

CWE-639

CWE-285

CWE-200

Related Identifiers

CVE-2026-31869

Affected Products

Discourse

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-31869 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5 · Note