CVE-2026-45780

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in Discourse

Publication date: 2026-07-09

Last updated on: 2026-07-09

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-09

Last Modified

2026-07-09

Generated

2026-07-11

AI Q&A

2026-07-10

EPSS Evaluated

N/A

NVD

CVE-2026-45780

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	to 2026.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Discourse, an open-source discussion platform. Before certain fixed versions (2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5), the EventSerializer component could expose sensitive information such as invited group names, sample invitees, and attendance statistics to users who were able to view the topic but were not authorized to see the private event invitee list.

Impact Analysis

The impact of this vulnerability is that unauthorized users can gain access to private event information, including the names of invited groups and attendees, which should have been restricted. This exposure can lead to privacy breaches and unintended disclosure of sensitive event participation details.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Discourse installation to one of the fixed versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.

Compliance Impact

This vulnerability in Discourse could lead to unauthorized exposure of private event invitee information, such as invited group names, sample invitees, and attendance statistics, to users who should not have access to this data.

Such unauthorized data exposure may impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive information to prevent unauthorized disclosure.

Therefore, until the vulnerability is fixed by upgrading to the specified versions, organizations using affected Discourse versions might face increased risk of non-compliance with these standards due to potential privacy breaches.

Hi! I’m here to help you understand CVE-2026-45780. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70