Discourse EUVD-2026-13490

The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) indicates low real-world urgency compared to the moderate base score: the attack requires network access (AV:N) with low complexity (AC:L), but critically requires prior authentication with moderator privileges (PR:L), which significantly restricts the attacker pool. The impact is confined to confidentiality (VC:L) with no integrity or availability impact, meaning data exfiltration rather than system compromise. Without disclosed EPSS data or KEV status indicating active exploitation, and given that patches are available and the vulnerability requires legitimate moderator credentials, this should be prioritized as a medium-priority update rather than a critical incident. Organizations running Discourse should apply patches promptly but need not declare emergency response; however, forums with sensitive moderation activities or strict data governance should treat this with higher urgency.

A moderator with permissions to moderate only a specific category (e.g., 'Support') exploits the authorization bypass to query the API endpoint that returns post metadata, retrieving sensitive information such as IP addresses, email references, or system flags from posts in restricted categories they should not access (e.g., 'Private Staff Discussion'). The attack succeeds because the authorization check at the metadata endpoint fails to validate the moderator's assigned scope, allowing the attacker to exfiltrate data in a single automated API call. Such a scenario could expose private user information or internal team discussions if a moderator account is compromised or if a malicious internal moderator seeks to access unauthorized content.