Discourse EUVD-2026-13496

The CVSS 4.0 score of 5.3 reflects a low-impact information disclosure (Confidentiality: Low) with network accessibility and low attack complexity, but critically requires prior authentication (PR:L). The attack vector is Network and the scope is unchanged. However, real-world risk must be contextualized: the vulnerability requires an attacker to already have authenticated access and messaging permissions with the target group, significantly narrowing the threat actor pool. The exploit is automatable and does not require user interaction, which increases practical risk. EPSS data is unavailable from the provided intelligence, limiting probabilistic exploitation assessment. KEV (Known Exploited Vulnerabilities) status is unknown, suggesting no active exploitation has been reported in coordinated attack campaigns at time of publication. The technical impact is information disclosure only—no code execution, privilege escalation, or integrity impact. For organizations running hidden-membership groups containing sensitive member lists (e.g., security teams, HR groups), this poses elevated risk despite moderate CVSS. For general-purpose forums with public group membership, impact is negligible. The vulnerability is patched in three concurrent versions, indicating vendor responsiveness.

An authenticated user on a Discourse instance with basic messaging permissions targets a hidden-membership security team group. The attacker uses the ComposerController#mentions endpoint with the group name and iteratively probes a list of employee usernames, observing that certain usernames return 'private' in the user_reasons field while others do not. Over multiple queries, the attacker constructs a complete roster of the security team's membership despite the group's hidden-visibility settings, potentially identifying employees working on sensitive initiatives or investigations. The attack requires no user interaction, can be fully automated via HTTP requests, and leaves minimal forensic traces if logging is not enabled at verbose levels.