CVE-2026-24742

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-01-30

Assigner: GitHub, Inc.

Description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This allows moderators to bypass intended access controls and extract confidential data by monitoring the staff action logs. With leaked webhook secrets, an attacker could potentially spoof webhook events to integrated services. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site administrators should review and limit moderator appointments to fully trusted users. There is no configuration-based workaround to prevent this access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-01-30

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-24742

EUVD

EUVD-2026-4869

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	to 3.5.4 (exc)
discourse	discourse	From 2025.11.0 (inc) to 2025.11.2 (exc)
discourse	discourse	2025.12.0
discourse	discourse	2026.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows non-admin moderators to view sensitive information in staff action logs that should only be accessible to administrators. The exposed data includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This means moderators can bypass access controls and extract confidential data by monitoring these logs.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information to non-admin moderators, including secrets and API keys. This could allow an attacker with moderator privileges to spoof webhook events to integrated services using leaked webhook secrets, potentially compromising system integrity and confidentiality. It also risks exposure of private messages and restricted content, undermining trust and security within the platform.

Mitigation Strategies

To mitigate this vulnerability immediately, site administrators should review and limit moderator appointments to fully trusted users. Additionally, upgrading Discourse to one of the patched versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 is necessary. There is no configuration-based workaround to prevent this access.

Hi! I’m here to help you understand CVE-2026-24742. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70