EUVD-2026-60237Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint requires authenticated session (PR:L); confidentiality impact is low (draft titles and excerpts only); no integrity or availability impact applies.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
AnalysisAI
Information disclosure in Discourse allows authenticated group members to access unpublished shared-draft content through improperly guarded API endpoints. Group members holding view-only activity permissions - but explicitly excluded from shared-draft access - can retrieve draft topic titles and post excerpts via the group posts and group mentions endpoints due to a missing authorization check (CWE-862). Fixed versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
Discourse is an open-source, Ruby on Rails-based discussion platform widely used for community forums and internal collaboration. The vulnerability stems from CWE-862 (Missing Authorization): the backend endpoints handling group posts and group mentions responses aggregate content without enforcing the shared-draft visibility permission gate that applies elsewhere in the platform. Shared drafts in Discourse are a feature allowing moderators or designated users to collaboratively author content before publishing; they carry an explicit access-control flag that should restrict visibility. The affected code paths fail to check this flag when constructing API responses, leaking draft topic titles and post body excerpts to any authenticated group member who can view group activity - regardless of whether that member was explicitly denied shared-draft access. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network reachability, low-privilege authentication, and limited confidentiality impact consistent with a partial data exposure rather than full system compromise.
RemediationAI
Upgrade Discourse to one of the patched releases: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, selecting the branch that matches the currently deployed version. Patch details and release notes are available via the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-fxw4-38v9-76v8. If an immediate upgrade is not feasible, a compensating control is to revoke group activity view permissions from any group whose members should not have access to shared drafts - this removes the exploitable surface by eliminating the permission combination that triggers the flaw, at the cost of reducing visibility into group post activity for those members. Alternatively, administrators can temporarily disable the shared-draft feature entirely until patching is completed, preventing any draft content from being available through these endpoints. Both workarounds carry operational trade-offs and should be treated as temporary measures only.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today