EUVD-2026-60238Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with no authentication or user interaction required; confidentiality impact is low because only first-post excerpts are disclosed, not credentials or full database contents.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
AnalysisAI
Hidden post content disclosure in Discourse allows unauthenticated visitors and search-engine crawlers to read first-post content that was explicitly hidden or made unviewable through moderation controls. Affected versions span multiple release branches prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Discourse instance where at least one topic has its first post set to a hidden or unviewable state via Discourse's moderation system (for example, a post flagged and suppressed by moderator action or automated thresholds). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score with AV:N/AC:L/PR:N/UI:N reflects the ease of access - any unauthenticated HTTP request to an affected topic page retrieves the disclosure - but the C:L impact rating correctly reflects that only partial content (first-post excerpts) is exposed, not full database contents or credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Discourse to one of the patched releases: 2026.1.6 on the stable track, 2026.5.2 on the beta track, 2026.6.1 on the tests-passed track, or 2026.7.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today