CVE-2026-24742
BaseFortify
Publication date: 2026-01-28
Last updated on: 2026-01-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | to 3.5.4 (exc) |
| discourse | discourse | From 2025.11.0 (inc) to 2025.11.2 (exc) |
| discourse | discourse | 2025.12.0 |
| discourse | discourse | 2026.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows non-admin moderators to view sensitive information in staff action logs that should only be accessible to administrators. The exposed data includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This means moderators can bypass access controls and extract confidential data by monitoring these logs.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information to non-admin moderators, including secrets and API keys. This could allow an attacker with moderator privileges to spoof webhook events to integrated services using leaked webhook secrets, potentially compromising system integrity and confidentiality. It also risks exposure of private messages and restricted content, undermining trust and security within the platform.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, site administrators should review and limit moderator appointments to fully trusted users. Additionally, upgrading Discourse to one of the patched versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 is necessary. There is no configuration-based workaround to prevent this access.