Discourse EUVD-2026-17555

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates low impact: network-accessible, low attack complexity, requiring authenticated login, no user interaction, confined scope, and minimal confidentiality loss. The real-world risk is moderate for organizations with strict channel privacy policies (e.g., teams with confidential projects or hr-only channels), but limited for open communities. No public exploit code or active exploitation has been identified; the vulnerability is an authorization bypass rather than remote code execution. EPSS exploitation probability data is not provided, so assessment relies on CVSS analysis and patch availability. This represents a privacy control failure rather than a critical security flaw, making it a priority for administrators managing sensitive workspaces but not an emergency for public community forums.

An authenticated user on a Discourse instance performs a chat user search with crafted queries targeting known usernames or profiles, observing subtle differences in search result metadata or presence indicators that correlate with membership in private channels they should not be able to access. By systematically querying users and cross-referencing visible activity patterns, the attacker maps membership in confidential channels (e.g., staff-only discussions, customer-specific groups) without direct access to those channels. No public proof-of-concept code has been published, but the attack requires only standard platform authentication and normal user search functions.