CVE-2026-55704
Received Received - Intake

Information Disclosure in Discourse Group Activity

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-55704
EUVD
EUVD-2026-60237

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
discourse discourse to 2026.1.6|end_excluding=2026.5.2|end_excluding=2026.6.1|end_excluding=2026.7.0 (exc)
discourse discourse 2026.1.6
discourse discourse 2026.5.2
discourse discourse 2026.6.1
discourse discourse 2026.7.0
discourse discourse to 2026.1.6 (exc)
discourse discourse to 2026.5.2 (exc)
discourse discourse to 2026.6.1 (exc)
discourse discourse to 2026.7.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse allows users with limited permissions to view shared draft titles and excerpts through group post serialization. Users who could see a group’s activity but lacked permission to view shared drafts could still access shared-draft entries via group posts and mentions endpoints, leading to disclosure of unpublished draft content.

Detection Guidance

Check Discourse version with: grep -r "version" /var/www/discourse/config/app.yml. If version is below 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, the system is vulnerable.

Impact Analysis

The vulnerability could lead to unauthorized disclosure of unpublished draft content, including topic titles and post excerpts. This may expose sensitive information before it is ready for public release, potentially affecting confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of unpublished draft content, including sensitive information. This may violate data protection principles under GDPR (e.g., Article 5 on integrity and confidentiality) and HIPAA (e.g., safeguards for protected health information). Organizations using affected Discourse versions may face compliance risks if drafts contain regulated data.

Mitigation Strategies

Upgrade Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 or later. No official workarounds exist; patching is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart