What is the CVSS score of CVE-2026-30891?

CVE-2026-30891 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-30891?

Organizations using the user actions endpoint. should be aware of notable risk from CVE-2026-30891, a information exposure vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-30891?

Within 30 days: Identify affected systems running the user actions endpoint. and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Discourse CVE-2026-30891

EUVD-2026-13492 MEDIUM

Information Exposure (CWE-200)

2026-03-20 security-advisories@github.com

Information Disclosure Discourse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.2,2026.2.1

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13492

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activity due to insufficient authorization checks in the user actions endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

AnalysisAI

Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain an authorization bypass vulnerability in the user actions endpoint that allows authenticated users to access other users' private activity data. An attacker with valid login credentials can enumerate and view private user actions without proper permission checks, resulting in information disclosure. This is a moderate-severity issue with a CVSS score of 5.3 that requires authentication to exploit but has no known active exploitation or public proof-of-concept at this time.

Technical ContextAI

The vulnerability resides in Discourse's user actions API endpoint, which is responsible for retrieving activity logs and user interaction history. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating insufficient authorization validation at the API layer. The endpoint fails to properly verify that the requesting user has permission to access the target user's private activity data before returning sensitive information. This is a classic broken access control issue where the application enforces authentication (the user must be logged in) but does not enforce proper authorization (the user must have explicit permission to view that specific data). The vulnerability affects Discourse's core activity tracking and user privacy features, which rely on proper access controls to protect sensitive user behavior and interaction history.

RemediationAI

Upgrade Discourse to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 or later depending on which branch your instance is running. Apply the patch by following your Discourse update procedure (typically via Admin Dashboard or Docker image update). Until patching is feasible, implement network-level access controls by restricting Discourse API access to trusted internal IP ranges or networks, and audit API logs for suspicious user activity enumeration patterns. Review and disable any third-party plugins or customizations that access the user actions endpoint without proper authorization checks. The vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-ww5f-24g5-c33g provides additional context and patch verification steps.