PT-2026-76680 · Discourse · Discourse

CVE-2026-53960

·

Published

2026-08-17

·

Updated

2026-08-21

CVSS v3.1

5.3

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0
Description Hidden or unviewable first-post content is leaked as an excerpt within the publicly-served Q&A (QAPage) JSON-LD structured data. This allows unauthenticated visitors and search-engine crawlers to access content that should otherwise be restricted.
Recommendations Update to version 2026.1.6 Update to version 2026.5.2 Update to version 2026.6.1 Update to version 2026.7.0

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2026-53960
CVE-2026-53960
GHSA-J5J7-W5G3-43Q8

Affected Products

Discourse