CVE-2026-34947
Information Disclosure in Discourse Public Invite Pages
Publication date: 2026-04-03
Last updated on: 2026-04-22
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | 2026.3.0 |
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (inc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes staged user custom fields and usernames on public invite pages without email verification, potentially leading to unauthorized disclosure of user information.
Such unauthorized exposure of user data could impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal information and ensuring proper access controls.
However, specific impacts on compliance or regulatory obligations are not detailed in the provided information.
Can you explain this vulnerability to me?
This vulnerability affects the Discourse open-source discussion platform in certain versions before they were patched. Specifically, from versions 2026.1.0 up to but not including 2026.1.3, 2026.2.0 up to but not including 2026.2.2, and 2026.3.0 up to but not including 2026.3.0, there is an issue where staged user custom fields and usernames are exposed on public invite pages without requiring email verification.
This means that sensitive user information that should be protected until verification can be viewed publicly on invite pages, potentially exposing user data prematurely.
How can this vulnerability impact me? :
The impact of this vulnerability is that sensitive user information, such as custom fields and usernames of staged users, can be accessed publicly without the user having verified their email. This could lead to privacy concerns, unauthorized data exposure, and potential misuse of user information.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade your Discourse installation to one of the patched versions: 2026.1.3, 2026.2.2, or 2026.3.0.
These versions fix the issue where staged user custom fields and usernames are exposed on public invite pages without email verification.