Discourse EUVD-2026-17567

CVSS 2.0 and the low severity vector (AV:N/AC:H/AT:P/PR:L/UI:A with VC:L/VI:L and no integrity or availability impact) correctly reflect that this is information disclosure with constrained attack surface: requires network access, high complexity (multisite cluster setup), requires prior timing/preparation (AT:P), authenticated login, and user interaction. However, real-world risk is elevated beyond the score because Stripe API keys are highly sensitive - they grant access to payment data, customer PII, and financial transactions. An attacker with authenticated access to one site in a cluster can extract keys valid for all sites, enabling fraud, data theft, and lateral privilege escalation. The specificity of the multisite setup constraint (not all Discourse deployments use multisite) somewhat limits total affected population. EPSS data not provided; no KEV status or public POC identified, suggesting limited real-world exploitation. This is a legitimate but contained risk - patch promptly for any multisite Discourse cluster handling payments.

An attacker gains authenticated access to one site (Site A) in a multisite Discourse cluster, either through credential reuse or social engineering. The attacker navigates to the payment or subscription settings page and observes that the interface displays Stripe API keys belonging to Site B, another organization's forum on the same cluster. The attacker copies these keys and uses them to query Stripe's API directly, accessing transaction history, customer lists, and financial data for Site B's customers. No exploit code is required; the leak is triggered by normal administrative UI interaction.