CVE-2026-27935

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a flaw in an API endpoint. This endpoint allows the disclosure of private topic metadata belonging to administrator users to moderator users, even when those moderators do not have authorized access to the private topics. The affected API endpoint exposes sensitive information.

Recommendations Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.