Discourse EUVD-2026-86297

Requires (1) an authenticated Discourse moderator account, (2) the Discourse AI plugin generating reviewables, and (3) a pre-existing AI reviewable associated with a private-message topic that the moderator is NOT a participant in. The flaw is that Reviewable.viewable_by did not restrict private-message reviewables to the audience allowed to access the underlying PM topic. Limiting factors: high privilege (moderator role), dependence on the optional Discourse AI feature, and the opportunistic requirement that such a reviewable already exists - the attacker cannot reliably force one to be created. Ability to modify (close topic / delete post) is further gated on which reviewable actions are available.

This is a low-to-moderate real-world risk despite the sensitive confidentiality impact. The vendor CVSS 3.1 base score of 4.2 (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) is dominated by strong limiting factors: exploitation requires an already-privileged authenticated moderator account (PR:H) AND a pre-existing Discourse AI reviewable that happens to be tied to a private-message topic (AC:H). This is an insider/abuse-of-trust authorization flaw (CWE-862 missing authorization), not a remotely-triggerable pre-auth bug. There is no CISA KEV listing, no EPSS score provided, and no public proof-of-concept identified - consistent with a low likelihood of opportunistic mass exploitation. One internal inconsistency worth noting: the official vector sets I:N, but the description explicitly states the moderator 'could also modify the private message by closing its topic or deleting a post,' which is an integrity/availability effect - so the I:N metric arguably understates impact when the reviewable exposes those actions. Overall this should be prioritized as a patch-during-normal-cycle privacy fix for operators running the Discourse AI plugin, not an emergency.

A moderator on a Discourse instance running the Discourse AI plugin opens the standard moderation review queue and finds an AI-generated reviewable that references a private message they are not a participant in. Because reviewable visibility filtering fails to scope private-message reviewables to the PM's permitted audience, the moderator reads the confidential message content and, if the reviewable offers those actions, can close the PM topic or delete a post. No public exploit code has been identified; exploitation is manual abuse of an existing moderator account.