What is the CVSS score of CVE-2026-31869?

CVE-2026-31869 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-31869?

Organizations using Discourse should be aware of moderate risk from CVE-2026-31869, a information exposure vulnerability rated CVSS 4.3.. A patch is available.

How to fix or mitigate CVE-2026-31869?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Discourse CVE-2026-31869

EUVD-2026-13496 MEDIUM

Information Exposure (CWE-200)

2026-03-20 security-advisories@github.com

Information Disclosure Discourse

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.1,2026.1.2

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13496

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.

AnalysisAI

Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contains an information disclosure vulnerability in the ComposerController#mentions endpoint that reveals hidden group membership to any authenticated user capable of messaging the group. An attacker can exploit this by supplying hidden-membership group names and probing arbitrary usernames to infer membership based on whether the user_reasons field returns 'private', effectively bypassing group member-visibility controls designed to protect sensitive group information. This vulnerability is not known to be actively exploited in the wild (KEV status unknown), carries a moderate CVSS score of 5.3 reflecting low confidentiality impact with low attack complexity, and requires prior authentication.

Technical ContextAI

The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) in Discourse's message composer functionality. Specifically, the ComposerController#mentions endpoint fails to properly enforce access controls when validating group names supplied via the allowed_names parameter. When a user probes membership of a hidden-membership group, the endpoint returns user_reasons data containing a 'private' indicator if the queried username exists in the group, while returning different indicators for non-members or non-existent users. This information leakage occurs despite the group having hidden membership visibility settings. The root cause is insufficient authorization checking that assumes users cannot meaningfully interact with groups they are not supposed to access, but the endpoint permits authenticated users with basic messaging permissions to query the endpoint and extract membership details through pattern analysis.

RemediationAI

Immediately upgrade Discourse to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 or later, depending on your current minor version—see https://github.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5 for version-specific guidance. Until patching is feasible, apply the vendor-recommended workaround: restrict the messageable policy of any hidden-membership group to staff or group members only, preventing untrusted authenticated users from reaching the vulnerable endpoint code path. This eliminates the attack precondition (ability to message the group) while maintaining intended group confidentiality. Verify group settings in the Discourse admin panel and audit existing group messageable policies to identify and remediate high-risk configurations.