CVE-2026-31869

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. The ComposerController#mentions API endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user reasons returns "private" for a given user. This bypasses group member-visibility controls.

Recommendations Restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.