Executive brief
Discourse is an open-source platform used for hosting community discussions and forums. A security flaw in the chat management component allowed forum moderators to view the names and member counts of private or hidden groups they were not authorized to see. While this does not allow access to the actual messages within those groups, it could lead to the exposure of sensitive organizational structures or private community associations.
Technical details
An authorization bypass vulnerability exists in the Discourse Category Chatables Controller's 'show' action. The 'permissions' endpoint failed to properly filter groups based on visibility rules, allowing users with moderator privileges to retrieve metadata (names and member counts) for hidden or private groups. The root cause was a lack of group visibility checks in the database query within the chat plugin's API. This issue has been resolved by implementing 'visible_groups' filtering in the controller to ensure only groups the current user is authorized to see are returned. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse >= 2026.1.0-latest, < 2026.1.3; >= 2026.2.0-latest, < 2026.2.2; >= 2026.3.0-latest, < 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched