Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allowed forum moderators to access and export sensitive administrative reports that should have been restricted to site administrators only. This could lead to the exposure of sensitive operational data, such as top file uploads or site-wide activity metrics, to unauthorized staff members.
Technical details
An improper authorization vulnerability (CWE-200) exists in Discourse's CSV export functionality. The 'export_csv_controller.rb' and 'guardian.rb' components failed to properly validate that a user had administrator privileges before allowing the export of specific reports, such as 'top_uploads'. An attacker with moderator-level privileges could exploit this by sending a request to the CSV export endpoint for restricted report IDs. This bypasses the intended report visibility restrictions, allowing moderators to download sensitive operational data intended only for administrators. The issue has been addressed in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched