What is the CVSS score of CVE-2026-59828?

CVE-2026-59828 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-59828?

Yes, a patch is available for CVE-2026-59828. Update the affected software to the latest version immediately.

Discourse CVE-2026-59828

EUVD-2026-42737 MEDIUM

Information Exposure (CWE-200)

2026-07-09 security-advisories@github.com

Information Disclosure Discourse

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-exploitable without authentication or user interaction; impact limited to partial confidentiality loss of hidden revision content with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:48 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Discourse's post revision system exposes hidden edit history to unauthenticated network users through a serialization flaw in PostRevisionSerializer. When computing diffs between adjacent visible revisions, the serializer failed to enforce visibility restrictions, leaking content from revisions that moderators or administrators had marked as hidden. No active exploitation has been identified at time of analysis, but the unauthenticated, low-complexity attack vector means any visitor to a vulnerable Discourse instance can potentially access suppressed post content - including moderator-redacted material - without any credentials or special access.

Technical ContextAI

Discourse is an open-source Ruby on Rails-based discussion platform. The vulnerability resides in PostRevisionSerializer, the component responsible for serializing post edit history and generating revision diffs for client consumption. Post revisions can be individually hidden from regular users - a common moderation action to remove sensitive disclosures, PII, or inappropriate content from public view. The serializer failed to apply these visibility access controls consistently when computing diffs between adjacent revisions, causing hidden revision content to bleed into the serialized output for neighboring visible revisions. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) precisely characterizes the root cause: an access control enforcement gap at the serialization layer, not at the data storage or retrieval layer. No CPE strings were provided in the available data; affected scope is identified from the GitHub release history across multiple maintained branches.

RemediationAI

Upgrade Discourse to one of the patched releases corresponding to your active branch: v2026.6.0, v2026.5.1, v2026.4.2, or v2026.1.5. Fix commits are available at the Discourse GitHub repository (commits 1f26c116, 8b773332, 8d36da1b, d58988d4) and the full security advisory is at https://github.com/discourse/discourse/security/advisories/GHSA-q456-4f8q-42vx. If an immediate upgrade is not feasible, a compensating control is to restrict access to the post revision history API endpoints (typically /posts/:id/revisions/) via web server rules or a WAF, accepting the trade-off that all users - including legitimate ones - will lose access to revision diffs until the upgrade is applied. No vendor-documented workarounds beyond patching are identified in available data.