What is the CVSS score of CVE-2026-30889?

CVE-2026-30889 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-30889?

Organizations using Discourse should be aware of moderate risk from CVE-2026-30889, a missing authorization vulnerability rated CVSS 4.9. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2026-30889?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-30889

EUVD-2026-13490 MEDIUM

Missing Authorization (CWE-862)

2026-03-20 security-advisories@github.com

Authentication Bypass Discourse

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.2,2026.2.1

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13490

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorization checks to access metadata of posts they should not have permission to view. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

AnalysisAI

A moderator authorization bypass vulnerability in Discourse allows authenticated moderators to access post metadata they should not have permission to view due to insufficient authorization checks. The vulnerability affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, with patched versions now available. While the CVSS score of 5.3 indicates moderate severity and the attack requires authenticated access with moderator privileges, this represents a meaningful confidentiality risk in multi-tenant forum environments where metadata isolation between moderation scopes is critical.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of weakness where an application fails to properly implement access control checks for protected resources. In Discourse, the issue manifests in the authorization logic that governs access to post metadata—information such as edit history, flag reasons, user IP addresses, or other sensitive metadata that should be restricted based on moderator scope and forum policies. The root cause appears to be insufficient validation of whether a moderator's authorization level and assigned scope permit access to specific post records before returning associated metadata. Discourse, being an open-source discussion platform written in Ruby on Rails, relies on its authorization middleware and database query filters to enforce these restrictions; the bug indicates a gap where metadata retrieval bypassed these protective layers.

RemediationAI

Upgrade Discourse to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 or later as appropriate to your current release train; consult https://github.com/discourse/discourse/security/advisories/GHSA-5qm9-r98f-g4mq for detailed patch instructions. For instances unable to patch immediately, implement compensating controls by restricting moderator account privileges to only those moderators requiring access to sensitive categories, and audit moderator activity logs to detect unauthorized metadata access attempts. Additionally, consider implementing network segmentation to limit moderator IP ranges if operationally feasible, and review and tighten Discourse authorization policies to enforce principle of least privilege for moderator role assignments.