Incorrect authorization in Discourse - #VU166072
Published: November 12, 2026
Vulnerability identifier: #VU166072
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to read new messages from restricted category chat channels without permission to join them or read their history.
The vulnerability exists due to incorrect authorization in Discourse MessageBus when delivering chat messages for restricted categories. A remote user can receive messages in real time through membership in a group with only "See" permission, without "Reply" or "Create" permission, to access otherwise unauthorized chat content.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1