Quick answers
- Is CVE-2026-55704 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-55704 being exploited in the wild.
- How severe is CVE-2026-55704?
- Medium severity, with a CVSS score of 4.3, published 17 August 2026.
- Which products and versions are affected?
- Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
- Is there a fix for CVE-2026-55704?
- A patch was published on 2026-08-17. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-55704 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-55704?
- Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An information disclosure vulnerability exists in Discourse's group post and group mentions API endpoints where shared-draft post entries are incorrectly included in serialized responses. The root cause is insufficient authorization checks in the post serialization logic that fails to filter out shared-draft content for users who lack explicit permission to view drafts. An authenticated user with permission to view group activity can exploit this by accessing the group posts or group mentions endpoints to retrieve draft topic titles, excerpts, and full post content. The vulnerability requires low privileges (group member access) and no user interaction, with network-based attack vector. Patches are available in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0; no workarounds are documented.
Affected products
- Discourse Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
Timeline
- 2026-07-28: disclosed
- 2026-08-17: patched