Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allows logged-in users to view the titles of private 'shared draft' topics that they should not have permission to see. While the full content of the posts remains protected, the exposure of topic titles could leak sensitive internal information or upcoming announcements.
Technical details
An information disclosure vulnerability exists in the Discourse 'Oneboxer' component due to an improper authorization check. The 'Oneboxer.local_topic' method incorrectly skipped the 'can_see_topic?' validation if the 'category_id' provided in an inline onebox request matched the target topic's category. An authenticated attacker can exploit this by sending a crafted request with a category ID matching the shared drafts category to retrieve restricted topic titles. This bypasses access controls intended for the 'shared_drafts_allowed_groups'. The vulnerability is patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to 2026.1.2, 2026.2.0-latest to 2026.2.1, 2026.3.0-latest before 2026.3.0
Timeline
- 2026-03-31: advisory
- 2026-03-31: patched