CVE-2026-59829

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.1

Description On sites with category group moderation enabled, the review queue may expose an excerpt and a permalink of private messages attached to a flag. This occurs even if the reviewing category moderator was not a participant in the message. These notify moderators flag messages are intended only for moderators and specific category moderation groups. Consequently, a category group moderator could access flag-discussion content without proper authorization. This issue impacts core flags raised before a moderator's group was granted category moderation and official plugins that generate such messages. The impact is limited to the confidentiality of a small excerpt of these private messages, with no possibility of modifying or deleting content.

Recommendations Update to version 2026.1.6 Update to version 2026.5.2 Update to version 2026.6.1 Update to version 2026.7.1