Description

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T16:16:59.057Z",
  "pubdate": "2026-08-17T16:16:59.057Z",
  "executiveSummary": "An information disclosure vulnerability has been identified in Discourse, an open-source discussion platform, impacting versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability allows users who possess permissions to view a specific group's activity, but lack the necessary privileges to view shared drafts, to improperly access sensitive data. Through the affected group posts and group mentions endpoints, unauthorized users can successfully retrieve shared-draft entries.\nThe successful exploitation of this flaw results in the unauthorized disclosure of unpublished draft material, specifically exposing confidential shared-draft topic titles along with post excerpts and content. This compromises the confidentiality of sensitive collaborative content within the platform. The risk implications include the potential exposure of sensitive organizational discussions, pre-publication announcements, and internal deliberations to unauthorized group members.\nAttackers require low privilege capabilities—specifically, the ability to view a group's activity—to exploit the endpoints. No advanced exploitation requirements or complex interaction vectors are necessary beyond interacting with the vulnerable group posts and group mentions endpoints.",
  "technicalDetails": "The vulnerability stems from an authorization bypass and inadequate access control validation within the group posts and group mentions endpoints in Discourse. The root cause is a failure in the application logic to properly enforce permission boundaries regarding shared drafts when processing requests for group activity data.\nSpecifically, when a user queries the group posts or group mentions endpoints, the backend application fails to cross-reference the requesting user's explicit permissions to view shared drafts associated with the group. Consequently, even if a user is restricted from accessing shared drafts directly, the endpoints inadvertently query and return shared-draft entries alongside standard posts and mentions.\nThe vulnerable components reside within the backend routing and controller logic handling group activity, specifically the endpoints responsible for generating group posts and group mentions responses. The affected versions include all Discourse installations prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user with permission to view a target group's general activity sends an HTTP request to the group posts or group mentions endpoint. Second, the backend controller processes the request without validating whether the user has explicit authorization to view shared drafts. Third, the database query retrieves entries including unpublished shared drafts. Fourth, the server serializes and returns this restricted data in the API response. Finally, the unauthorized user receives the payload, leading to the exposure of confidential topic titles and post contents.\nThe post-exploitation impact is limited to information disclosure, allowing attackers to harvest unpublished draft materials, gain unauthorized insights into future topics, and potentially leverage leaked details for subsequent targeted attacks or social engineering."
}