CVE-2026-21865
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-01-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.5.4 (exc) |
| discourse | discourse | From 2025.11.0 (inc) to 2025.11.2 (exc) |
| discourse | discourse | 2025.12.0 |
| discourse | discourse | 2026.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Discourse allows moderators to convert some personal messages into public topics even when they should not have the access to do so. This means that private communications can be exposed publicly by moderators due to improper access controls in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of private messages, compromising user privacy and confidentiality. This could damage trust in the platform, expose sensitive information, and potentially lead to reputational harm or legal consequences for the site operators.
What immediate steps should I take to mitigate this vulnerability?
Site administrators should temporarily revoke the moderation role from untrusted moderators or remove the moderator group from the "personal message enabled groups" site setting until the Discourse instance is upgraded to a patched version (3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0).
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows moderators to convert personal messages to public topics without proper access, potentially exposing private or sensitive information. Such unauthorized disclosure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data from unauthorized access or exposure.