Discourse EUVD-2026-42740

Exploitation requires that the target Discourse installation has event functionality enabled and that at least one topic contains a private event with a configured invitee list. The disclosure is triggered passively by any user who can view the topic - on open forums this includes unauthenticated visitors; on restricted forums it includes any account with topic-read permission. No elevated privileges, special configuration, or user interaction is required beyond topic-read access. The limiting factor is deployment context: Discourse instances without event functionality, or with no topics using private invitee lists, have no exposure to this specific flaw. The leaked data is scoped to event invitation metadata (group names, sample invitees, attendance statistics) and does not include full user account data, private messages, or non-event content.

The CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the risk profile: trivial access conditions (no authentication, no complexity, no user interaction) but bounded low-confidentiality impact. Real-world priority is moderate and context-dependent - Discourse deployments that host private events with restricted invitee lists face genuine privacy exposure, as group membership and attendee rosters can be used for targeted social engineering or to enumerate organizational structure. EPSS data was not provided in the available intelligence, so exploitation probability cannot be quantified beyond the CVSS vector. The vulnerability is not listed in CISA KEV and no public POC has been identified, which reduces urgency compared to the low access complexity. The most meaningful risk signal is the PR:N combined with C:L: on open or semi-open forums, this is passively exploitable by any visitor without any special tooling.

An unauthenticated visitor or low-privilege member on an open Discourse forum navigates to a topic containing a private event and retrieves the topic's JSON payload - either via the standard Discourse API endpoint or by inspecting browser network traffic. The EventSerializer returns the full private invitation metadata, including invited group names, a sample of invitee usernames, and attendance counts, without any authorization check. The attacker passively harvests organizational group membership and event attendance data without triggering any alerts or requiring any special tooling. No public exploit code has been identified, but the attack requires nothing beyond an HTTP GET request.