EUVD-2026-60237Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint requires authenticated session (PR:L); confidentiality impact is low (draft titles and excerpts only); no integrity or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
AnalysisAI
Information disclosure in Discourse allows authenticated group members to access unpublished shared-draft content through improperly guarded API endpoints. Group members holding view-only activity permissions - but explicitly excluded from shared-draft access - can retrieve draft topic titles and post excerpts via the group posts and group mentions endpoints due to a missing authorization check (CWE-862). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the attacker holds a valid authenticated session on the Discourse instance (PR:L per CVSS); (2) the attacker is a member of at least one group for which group activity viewing is enabled; and (3) the Discourse instance has the shared-drafts feature active and at least one shared draft exists. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk of this vulnerability is moderate-to-low for most organizations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Discourse to one of the patched releases: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, selecting the branch that matches the currently deployed version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today