Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.2
CVE-2026-84302: Discourse lets non‑participants read or delete private messages
CVE-2026-84302 · published 1 month ago
Summary
In older versions of the Discourse forum software, moderators who were not part of a private conversation could see that conversation in the AI review queue. This allowed them to read, edit or even delete the private messages. Upgrade to the latest release to restrict review access to only the participants involved.
What to do
- Update discourse to version 2026.7.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | discourse | discourse | < 2026.7.0 |
| Bitnami | – | discourse |
< 2026.7.0 Fix: upgrade to 2026.7.0
|
Original advisory text
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
References
- https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09... Patch
- https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216... Patch
- https://github.com/discourse/discourse/pull/42091 Patch
- https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc Vendor Advisory
- https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e9... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84302... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84302 Vendor Advisory
- https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published24 Sep 2026
Updated4 Nov 2026
First seen24 Sep 2026
Sources
CVE-2026-84302 · NVD
CVE-2026-84302 · MITRE
CVE-2026-84302 · OSV
GHSA-3rx9-fqgh-wfpc · GHSA
BIT-discourse-2026-84302 · OSV
Track software like this
Free during beta