CVE-2026-24742
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-01-30

Assigner: GitHub, Inc.

Description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This allows moderators to bypass intended access controls and extract confidential data by monitoring the staff action logs. With leaked webhook secrets, an attacker could potentially spoof webhook events to integrated services. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site administrators should review and limit moderator appointments to fully trusted users. There is no configuration-based workaround to prevent this access.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-28
Last Modified
2026-01-30
Generated
2026-06-16
AI Q&A
2026-01-29
EPSS Evaluated
2026-06-15
NVD
CVE-2026-24742
EUVD
EUVD-2026-4869
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
discourse discourse to 3.5.4 (exc)
discourse discourse From 2025.11.0 (inc) to 2025.11.2 (exc)
discourse discourse 2025.12.0
discourse discourse 2026.1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows non-admin moderators to view sensitive information in staff action logs that should only be accessible to administrators. The exposed data includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This means moderators can bypass access controls and extract confidential data by monitoring these logs.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information to non-admin moderators, including secrets and API keys. This could allow an attacker with moderator privileges to spoof webhook events to integrated services using leaked webhook secrets, potentially compromising system integrity and confidentiality. It also risks exposure of private messages and restricted content, undermining trust and security within the platform.

Mitigation Strategies

To mitigate this vulnerability immediately, site administrators should review and limit moderator appointments to fully trusted users. Additionally, upgrading Discourse to one of the patched versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 is necessary. There is no configuration-based workaround to prevent this access.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24742. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart