CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, allowing unauthorized users to access shared-draft entries through group posts and mentions, potentially disclosing unpublished draft material. This information disclosure could lead to the exposure of sensitive content, impacting user privacy and data integrity. Organizations using affected versions should prioritize upgrading to the patched releases (2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0) to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.