Skip to content
Heist/ feed
MediumFix available

Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables

Type: advisorySource: OSV1 source record

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Announced Source revision 1
Original source ↗

BIT-discourse-2026-84302

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:BIT-discourse-2026-84302

discourse

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
2026.7.0

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2026.7.0"
          }
        ]
      }
    ],
    "package": {
      "name": "discourse",
      "purl": "pkg:bitnami/discourse",
      "ecosystem": "Bitnami"
    },
    "severity": [
      {
        "type": "CVSS_V3",
        "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"
      }
    ],
    "database_specific": {
      "source": "https://github.com/bitnami/vulndb/tree/main/data/discourse/BIT-discourse-2026-84302.json"
    }
  }
]
Related CVEs
CVE-2026-84302

Source reference: /aliases

Publisher severity

medium

Source reference: /database_specific/severity

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-84302 · Medium

discourse

Event
#59637 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement