CVE-2026-30891
Received Received - Intake
Authorization Bypass in Discourse User Actions Exposes Private Data

Publication date: 2026-03-20

Last updated on: 2026-03-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activity due to insufficient authorization checks in the user actions endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-24
Generated
2026-06-16
AI Q&A
2026-03-20
EPSS Evaluated
2026-06-15
NVD
CVE-2026-30891
EUVD
EUVD-2026-13492
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
discourse discourse From 2026.1.0 (inc) to 2026.1.2 (exc)
discourse discourse From 2026.2.0 (inc) to 2026.2.1 (exc)
discourse discourse 2026.3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-30891 is a moderate severity vulnerability in the Discourse software that occurs due to insufficient authorization checks in the user actions endpoint.'}, {'type': 'paragraph', 'content': "This flaw allows a user to access another user's private activity types without proper permission, leading to unauthorized exposure of private user action data."}, {'type': 'paragraph', 'content': 'The issue affects Discourse versions prior to 2026.1.2, 2026.2.1, and 2026.3.0-latest.1, where patches have been applied to fix the problem.'}] [1]

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to access your private activity data on the Discourse platform.

Such unauthorized access compromises user privacy and may expose sensitive information related to user actions.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

[{'type': 'paragraph', 'content': 'To mitigate this vulnerability, you should upgrade your Discourse installation to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.'}, {'type': 'paragraph', 'content': "These versions contain the necessary patches that fix the insufficient authorization checks in the user actions endpoint, preventing unauthorized access to other users' private activity data."}] [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-30891. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart