Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-17T16:16:58.423Z",
  "pubdate": "2026-08-17T16:16:58.423Z",
  "executiveSummary": "An information disclosure vulnerability affects the Discourse open-source discussion platform prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability resides in the generation of Q&A (QAPage) JSON-LD structured data, where hidden or otherwise unviewable first-post content is improperly leaked as an excerpt. The primary impact of this security flaw is unauthorized data exposure, allowing unauthenticated remote visitors and automated search-engine crawlers to access sensitive or restricted text that should otherwise be protected by access control mechanisms. The risk implication is significant for communities relying on hidden or restricted initial posts, as sensitive context is inadvertently published in public-facing metadata. No special attacker capabilities, privileges, or complex authentication credentials are required to exploit this issue, as the vulnerable structured data is served publicly in the hypertext markup response of affected topics. Remediation requires updating the Discourse platform to the patched versions specified by the vendor.",
  "technicalDetails": "The vulnerability stems from improper handling of post visibility states within the Q&A (QAPage) JSON-LD structured data rendering engine of the Discourse platform. Specifically, when a topic is configured as a Q&A thread, the application constructs structured JSON-LD metadata to improve search engine optimization and semantic indexing. During the generation of this structured data, the algorithm extracts excerpts of the first post to populate the schema fields.\nThe root cause is the failure of the serialization logic to cross-reference the content visibility status, access control lists, or moderation states of the primary post before embedding its excerpt into the public JSON-LD payload. Consequently, hidden, deleted, soft-deleted, draft, or otherwise restricted first-post content is serialized into the document body regardless of whether the requesting user possesses permissions to view the underlying post.\nThe attack flow and exploitation method are entirely passive and direct. An unauthenticated remote attacker or an automated web crawler requests a vulnerable Q&A topic page over the network using standard HTTP/HTTPS protocols. The Discourse server processes the request and responds with the HTML document containing the inline JSON-LD script block. The vulnerable component parses and injects the restricted first-post content directly into the public structured data payload without requiring any user session, authentication tokens, or elevated privileges. Because search engine crawlers index these pages and public users view the raw source or rendered metadata, the sensitive information is extracted without leaving traditional application-layer access logs indicating a direct breach of restricted endpoints.\nThe affected versions comprise all Discourse instances running software releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Post-exploitation impact is limited to the unauthorized disclosure of confidential text contained within the initial posts of Q&A topics, which may lead to the exposure of private metadata, internal discussions, or sensitive community data intended exclusively for authorized participants."
}