EUVD-2026-60235Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L required as exploitation demands an authenticated category moderator role; C:L reflects excerpt-only confidentiality exposure with no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
AnalysisAI
Unauthorized private message excerpt exposure in Discourse allows authenticated category group moderators to read flag-related companion PM content they were never intended to access, via the review queue API. Affected are Discourse deployments with category group moderation enabled running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1. No public exploit exists and the issue is absent from CISA KEV; however, the missing authorization check (CWE-862) means any authenticated category group moderator can silently read confidential flag discussion excerpts, directly undermining the trust model of the platform's moderation system.
Technical ContextAI
Discourse's review queue serializes flag-related data including 'reviewable_conversations' - excerpts and permalinks of companion private messages (PMs) created when a user raises a notify_moderators flag or similar core flag type. The ReviewableScoreSerializer in the Ruby on Rails backend was missing an authorization guard method (include_reviewable_conversation?) that verifies whether the requesting user can actually see the associated meta_topic (the private message topic) before including it in the JSON API response. When the enable_category_group_moderation site setting is active, category-specific moderator groups may review flagged content in their assigned categories, but these groups were not always added as recipients of companion PMs - particularly for flags raised before the group was assigned moderation rights, or for core flags that only notify global moderators. The root cause is CWE-862 (Missing Authorization): the serializer returned sensitive PM data without verifying the caller's permissions against the PM's access control list. The fix, visible in commit 4df0e54, adds scope&.can_see?(object.meta_topic) as the conditional inclusion guard. A parallel fix in the discourse-post-voting plugin ensures category moderating groups are properly added as PM recipients at flag creation time.
RemediationAI
Upgrade Discourse to one of the vendor-patched releases: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1, as documented in GitHub security advisory GHSA-wmc6-pmxp-xw5w and implemented across commits 4df0e54, 58e45dc, 74c8522, and e56bd3e (PR #41527 at https://github.com/discourse/discourse/pull/41527). If an immediate upgrade is not feasible, the only effective workaround is to disable category group moderation by setting enable_category_group_moderation to false in Discourse admin settings - this eliminates the attack surface entirely but also removes the ability for non-admin groups to moderate specific categories, which may be operationally disruptive. No network-layer mitigations are effective, as the vulnerability is in a server-side JSON serializer accessible to any authenticated category moderator over standard HTTPS. After patching, administrators should be aware that flags raised before a group was granted category moderation may still reference PMs that group was not added to; the fix addresses serializer exposure but does not retroactively add groups to historical PMs.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today