CVE-2026-84302

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description AI reviewables associated with private messages may appear in the moderator review queue of a moderator who is not a participant in the message. This occurs because visibility filtering fails to restrict these reviewables to the authorized audience of the underlying private-message topic, enabling a moderator to read confidential content. Depending on the available action, the moderator may also modify the private message by deleting a post or closing its topic. Exploitation requires an authenticated moderator account and a pre-existing AI reviewable linked to a private message.

Recommendations Update to version 2026.1.6. Update to version 2026.5.2. Update to version 2026.6.1. Update to version 2026.7.0.