Discourse CVE-2026-30891

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) indicates low overall severity: the attack is network-accessible with low complexity, requires low privileges (authenticated user), and causes low confidentiality impact with no integrity or availability impact. The moderate CVSS score of 5.3 reflects the privacy concern but limited blast radius. No EPSS score, KEV listing, or public proof-of-concept has been reported, suggesting this is not currently actively exploited in the wild. The vulnerability has clear patch availability across multiple maintained version branches (2026.1.2, 2026.2.1, 2026.3.0-latest.1), which reduces real-world risk for organizations that can update promptly. Under SSVC framework, exploitation is unproven, the attack is not network-automatable (requires per-user enumeration), and technical impact is limited to confidentiality. This is a legitimate but not critical priority: organizations should patch in standard maintenance windows but need not treat this as emergency remediation.

An authenticated user (e.g., a regular community member) registers for the Discourse forum and then directly queries the user actions API endpoint with another user's ID in the request parameters (e.g., /user-actions?user_id=5). Due to missing authorization checks, the API returns that target user's private activity history, including private messages, non-public posts, and other sensitive actions. The attacker can repeat this process to systematically enumerate and map the private behavior of multiple users. No special tools or user interaction are required beyond standard HTTP requests.