CVE-2026-30889
Insufficient Authorization in Discourse Allows Unauthorized Metadata Access
Publication date: 2026-03-20
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-30889 is a moderate severity vulnerability in the Discourse open-source discussion platform, specifically in the discourse-user-notes component.
The issue is caused by insufficient authorization checks that allow a moderator to access metadata of posts they should not have permission to view.
This means that moderators could see information about posts that are supposed to be restricted from their view.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized exposure of post metadata to moderators who should not have access.
Such unauthorized access could result in privacy and security concerns, as sensitive information about posts may be revealed.
To mitigate this risk, it is recommended to upgrade Discourse to versions 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 where the issue has been patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade Discourse to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.