Discourse EUVD-2026-36558

The unauthenticated disclosure requires: both the chat plugin and discourse-calendar plugin enabled on the target instance, at least one calendar event linked to a chat channel, and that channel having a non-empty last_message value - no authentication or elevated privilege is required beyond the ability to view the calendar event. The thread-creation authorization bypass requires a logged-in user account with read-only access to a category whose associated chat channel is the target. The self-deleted-message restoration issue requires the original message author to have subsequently had their channel access revoked - a relatively uncommon administrative sequence. The moderator DM-leakage issue requires a moderator to open the flagged-message review UI for a channel while another channel (including a DM) has populated that channel's last_message slot with recent activity. Sites with the chat plugin disabled are fully unaffected; sites without discourse-calendar are unaffected by the anonymous disclosure issue specifically.

The published CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), but the PR:N and I:N assignments merit scrutiny: PR:N correctly reflects the worst-case unauthenticated calendar disclosure, yet three of the four sub-issues require an authenticated session (read-only user, message author, or moderator), and at least two produce integrity-class impacts (thread creation, message restoration) that the published I:N does not capture. EPSS at 0.04% (11th percentile) signals very low near-term exploitation probability, and the absence of a CISA KEV listing and public POC code confirms this is not a weaponized vulnerability. Real-world risk is highest for public-facing Discourse communities that have deployed both the chat and discourse-calendar plugins together, where private DM content could reach unauthenticated visitors without any user interaction. Sites with neither calendar nor chat enabled are entirely unaffected.

An anonymous visitor to a Discourse community that has both the chat and discourse-calendar plugins enabled requests a calendar event page whose event is linked to an active chat channel; the API response serializes that channel's last_message field, exposing private DM content to the unauthenticated visitor without any special tooling or prior access. In a separate scenario, a forum member with only read-only access to a restricted category sends a crafted API request to the chat thread-creation endpoint, successfully creating a thread despite their designated read-only role.