Executive brief
Discourse is an open-source platform used by organizations to host discussion forums and communities. A security flaw allowed regular users to view 'read receipts' for private, staff-only posts that they were not authorized to see. While the actual content of the private messages remained hidden, unauthorized users could see who had read the posts and at what time, potentially leaking information about staff activity and internal discussions.
Technical details
An information disclosure vulnerability exists in Discourse due to missing post-level authorization in the PostReadersController. Specifically, the 'index' action failed to verify if a user had permission to view a post before returning its reader metadata. This allowed authenticated non-staff users to query the API for read receipt information (who read a post and when) for staff-only 'whisper' posts. The vulnerability does not expose the post content itself. The issue is addressed by adding a 'guardian.ensure_can_see!' check in the affected controller. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, 2026.3.0-latest to before 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched