CVE-2026-84302

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS 3.1

4.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS

0.24% probability · 15th percentile

Public exploits

None in Exploit-DB

CISA KEV

Not listed

Weakness

CWE-862

Source

security-advisories@github.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.