Is there a patch available for CVE-2026-34947?

Yes, a patch is available for CVE-2026-34947. Update the affected software to the latest version immediately.

Discourse CVE-2026-34947

Q: What is the CVSS score of CVE-2026-34947?

CVE-2026-34947 has a CVSS 4.0 base score of 2.7 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-18882 LOW

Information Exposure (CWE-200)

2026-04-03 GitHub_M

Information Disclosure Discourse

2.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.7 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.2.2,2026.3.0

EUVD ID Assigned

Apr 03, 2026 - 22:15 euvd

EUVD-2026-18882

Analysis Generated

Apr 03, 2026 - 22:15 vuln.today

CVE Published

Apr 03, 2026 - 21:27 nvd

LOW 2.7

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0-beta expose staged user custom fields and usernames on public invite pages without requiring email verification. An unauthenticated remote attacker can enumerate user information and custom field data by accessing public invitation links, potentially gathering sensitive user attributes before account activation. The vulnerability has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0, with no public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

Discourse is built on Ruby on Rails and manages user account provisioning through invitation workflows. The vulnerability exists in the public invite page handler, which renders staged user records without proper access control. Staged users are incomplete user objects created during the invitation process but not yet activated via email verification. The root cause is improper input validation and access control (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The invite pages, which should only display minimal information, inadvertently expose the full custom fields object and username fields associated with these unverified accounts. Because invite URLs are typically shared or discoverable, any network-accessible invite page becomes an information disclosure vector for harvesting user attributes that were intended to remain private until email verification.

RemediationAI

Vendor-released patch: upgrade to Discourse 2026.1.3, 2026.2.2, or 2026.3.0 or later. Administrators should prioritize patching if custom fields contain sensitive user attributes. As an interim mitigation prior to patching, restrict public access to invite pages via web server configuration or firewall rules if operationally feasible. For detailed guidance, consult the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-4rcw-wq9x-54qw.