Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-17T16:17:01.687Z",
  "pubdate": "2026-08-17T16:17:01.687Z",
  "executiveSummary": "An access control vulnerability exists in Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1 on sites with category group moderation enabled.\nThe vulnerability allows unauthorized category group moderators to view excerpts and permalinks of private messages attached to flags, specifically notify_moderators flag messages, even when they are not participants in those messages.\nThe impact is limited to a loss of confidentiality regarding specific flag-related private message excerpts; attackers cannot modify or delete any content.\nThe affected systems are Discourse installations utilizing official plugins that create such messages and core flags raised prior to a moderator's group being granted moderation of the category.\nExploitation requires category group moderation to be enabled and an attacker to possess category group moderator privileges, allowing them to access the review queue and view unauthorized private message contents.",
  "technicalDetails": "The root cause of the vulnerability lies in improper authorization checks within the review queue component when handling notify_moderators flag messages attached to private messages.\nThese flag messages are addressed exclusively to moderators and, for core flags, to specific category moderation groups as they existed at the time the flag was raised.\nDue to a failure in validating the requesting user's current participation or authorization against the specific context of the flag-discussion content, category group moderators can read excerpts and permalinks of private messages they are fundamentally not authorized to access.\nThis affects official plugins generating these messages as well as core flags raised before a moderator's group was granted explicit moderation rights for the category.\nThe attack flow proceeds as follows: 1) A flag is raised on content, generating a private message directed to specific moderators or historical category moderation groups. 2) A category group moderator, who was not a participant in the private message and whose group may have been granted category moderation after the flag was raised, accesses the review queue. 3) The review queue improperly exposes an excerpt and permalink of the private message attached to the flag. 4) The unauthorized moderator reads the sensitive message content directly from the review queue interface.\nPrivilege requirements include possessing category group moderator privileges on a Discourse site with category group moderation enabled.\nPost-exploitation impact is strictly confined to unauthorized information disclosure of limited private message excerpts associated with flags."
}