Discourse EUVD-2025-19108

CVSS 7.5 (High) reflects network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and high confidentiality impact (C:H). However, several risk-reducing factors exist: (1) The vulnerability requires the attacker to be an existing user who previously belonged to a whisper-authorized group, narrowing the threat actor pool; (2) CVSS explicitly rates integrity and availability as none (I:N/A:N), limiting blast radius; (3) No KEV/CISA listing or active exploitation reported; (4) No public proof-of-concept; (5) Patches are available and straightforward to apply. The real-world SSVC impact is lower than numeric CVSS suggests because exploitation requires pre-existing account access and group membership history, and the impact is read-only (unauthorized information disclosure, not modification). This is a moderate-priority issue for Discourse administrators managing sensitive community discussions, but not an emergency for most deployments.

An administrator adds a community moderator to the whisper-authorized group to allow them to view sensitive moderation discussion whispers. The moderator reviews several whispers and then, after 6 months, is removed from the whisper group due to role change. However, due to this vulnerability, the former moderator can still access their own previously authored or viewed whispers through their post history or search functionality, potentially leaking sensitive moderation decisions, user reports, or confidential discussions to unauthorized parties. The attack requires no special tooling—only standard Discourse UI navigation—making discovery trivial and deniability high (appears as normal site usage). The CVSS AV:N/AC:L/PR:N rating is slightly inflated because practical exploitation requires account access and historical group membership, but the confidentiality impact (C:H) is accurate for sensitive community content.