Incorrect authorization in Discourse - #VU165861
Published: November 11, 2026
Vulnerability identifier: #VU165861
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read content from posts hidden by community flags or staff action without permission.
The vulnerability exists due to improper access control in Discourse’s RSS feeds, HTML descriptions, social metadata, and digest emails when generating content from hidden posts. A remote attacker can request a topic’s RSS feed to read a hidden first post’s full raw body, request topic pages to obtain hidden post excerpts through metadata, or receive digest emails containing excerpts from hidden replies selected as highest-scored posts to disclose restricted content.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1