Discourse EUVD-2026-18882

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N/VC:L) reflects low confidentiality impact with no integrity or availability risk-only sensitive data disclosure. The low CVSS score (2.7) aligns with the real-world risk profile: while unauthenticated and easily exploitable, the impact is confined to information leakage. EPSS data is not provided, but this falls into a typical information disclosure category with moderate operational concern but limited attack severity. The vulnerability does NOT appear on CISA KEV at time of analysis, and no public proof-of-concept is documented. However, exploitation is trivial-any attacker can request public invite pages and extract user metadata. The practical risk depends on what custom fields an instance stores (e.g., if custom fields contain email addresses, phone numbers, or internal identifiers, risk escalates). For Discourse administrators who use custom fields to store sensitive user attributes, this represents a real privacy leak; for instances using only standard fields, impact is lower but still a compliance concern. SSVC framing: exploitation is straightforward (no special conditions), impact is limited (confidentiality only), and the automatable nature of data extraction suggests this warrants patching promptly for privacy-sensitive deployments.

An attacker obtains or guesses a public invite URL (e.g., through enumeration or if shared in a forum thread). The attacker navigates to the invite page and inspects the HTML source or intercepts the JSON response, revealing the staged user's username, email address, and any custom field values attached to the account. If custom fields store sensitive internal identifiers or PII, the attacker can harvest this metadata without authentication or email verification. This data can then be used for targeted phishing, account takeover attempts, or privacy violations. No special complexity or user interaction is required; the attack is entirely passive reconnaissance.