What is the CVSS score of CVE-2026-26265?

CVE-2026-26265 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-26265?

An insecure direct object reference (IDOR) vulnerability in Discourse allows unauthorized access to private user field values for all directory users, including by unauthenticated attackers.

Is there a public PoC exploit available for CVE-2026-26265?

Yes, a public proof-of-concept exploit is available for CVE-2026-26265. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-26265?

Within 24 hours: Disable the directory feature or restrict access to authenticated users only; notify legal and compliance teams of potential data exposure. Within 7 days: Audit access logs to identify unauthorized data retrieval; notify affected users if private fields were exposed; evaluate alternative discussion platforms if mitigation is insufficient. Within 30 days: Upgrade to patched versions (2025.12.2, 2026.1.1, or 2026.2.0) once available; implement rate limiting and access controls on directory endpoints; conduct a full data exposure assessment.

Discourse CVE-2026-26265

HIGH

Incorrect Authorization (CWE-863)

2026-02-26 security-advisories@github.com

Authentication Bypass Information Disclosure Discourse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 26, 2026 - 16:24 nvd

HIGH 7.5

DescriptionGitHub Advisory

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The user_field_ids parameter in DirectoryItemsController#index accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (show_on_profile / show_on_user_card) that are enforced elsewhere (e.g., UserCardSerializer via Guardian#allowed_user_field_ids). An attacker can request GET /directory_items.json?period=all&user_field_ids=<id> with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering user_field_ids against UserField.public_fields for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user fields, or disable the user directory via the enable_user_directory site setting.

AnalysisAI

Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain an insecure direct object reference (IDOR) in the directory items endpoint that allows unauthenticated attackers to retrieve private user field values for all directory users. The vulnerability stems from missing authorization checks on the user_field_ids parameter, enabling bulk exfiltration of sensitive user data that should be restricted by visibility settings. No patch is currently available for affected deployments.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects the directory items component of Discourse. Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The user_field_ids parameter in DirectoryItemsController#index accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (show_on_profile / show_on_user_card) that are enforced el