What is the CVSS score of CVE-2026-45780?

CVE-2026-45780 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-45780?

Yes, a patch is available for CVE-2026-45780. Update the affected software to the latest version immediately.

Discourse CVE-2026-45780

EUVD-2026-42740 MEDIUM

Information Exposure (CWE-200)

2026-07-09 security-advisories@github.com

Information Disclosure Discourse

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Any user with topic-read access triggers disclosure over the network with no authentication; impact is limited to low confidentiality with no integrity or availability consequences.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 14, 2026 - 20:52 NVD

5.3 (MEDIUM) 4.3 (MEDIUM)

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:40 vuln.today

DescriptionNVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

EventSerializer in Discourse improperly exposes private event invitation metadata - including invited group names, sample invitee usernames, and attendance statistics - to any user who can view the topic, regardless of their authorization to access the private invitee list. All Discourse installations prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected when event functionality is in use. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial network vector (AV:N/AC:L/PR:N/UI:N) makes this passively accessible to any user - authenticated or not - with topic-read access on an open or semi-open forum.

Technical ContextAI

Discourse is a widely-deployed Ruby on Rails open-source discussion platform used for community forums, product support, and internal knowledge bases. The vulnerability resides in EventSerializer, the serialization layer responsible for structuring event-related data into JSON API responses for topic views. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) describes the root cause: the serializer includes private event invitation metadata - invited group names, sample invitee profiles, and attendance statistics - in the topic payload without verifying whether the requesting user is entitled to view the private invitee list. This is a missing authorization check at the serialization layer rather than a cryptographic or memory-safety flaw. The fix was applied across four commits (37969503, 4d46638, 6457ab71, 7deb4b69) addressing the same issue across multiple maintained release branches.

RemediationAI

Upgrade Discourse to one of the patched releases: v2026.6.0 (stable), v2026.5.1 (beta), v2026.4.2 (beta), or v2026.1.5 (LTS), available at the respective GitHub release tags referenced in the advisory. These are vendor-confirmed patch versions with upstream commits addressing the serializer access control flaw. If immediate patching is not feasible, a compensating control is to restrict topic-view access so that only fully trusted, explicitly authorized users can read topics containing private events - this reduces the disclosure surface but limits forum openness and may conflict with community access policies. Disabling event functionality entirely eliminates the attack surface with no security trade-off, though it removes the feature. No other vendor-documented workarounds are available in the provided intelligence.