Executive brief
Discourse, a popular open-source discussion and forum platform, contained a vulnerability where sensitive information in hidden post revisions could be exposed. Specifically, content that was intended to be hidden from regular users could be leaked through the 'diff' view of adjacent, visible post revisions. This could lead to the unauthorized disclosure of private information or deleted content to any user capable of viewing the post's history.
Technical details
An information disclosure vulnerability exists in Discourse's PostRevisionSerializer. The flaw occurs because the application fails to properly suppress differences (diffs) when a revision is marked as hidden but is adjacent to a visible revision. An attacker or regular user viewing the revision history of a post can see the content of hidden revisions by inspecting the changes displayed in the adjacent visible versions. The fix introduces a 'suppress_hidden_diffs?' check within the serializer to ensure that sensitive content from hidden revisions is not included in the serialized output for unauthorized users. This issue is resolved in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected products
- Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0
Timeline
- 2026-07-09: advisory
- 2026-07-09: disclosed
References
- https://github.com/discourse/discourse/commit/1f26c1163ce87a2abbd1d01780ab1b5fb16e75f6
- https://github.com/discourse/discourse/commit/8b773332b0f937dfcd894ed56d56fc5a81578d9d
- https://github.com/discourse/discourse/commit/8d36da1b68c906592abde3f2e94d505cdf097435
- https://github.com/discourse/discourse/commit/d58988d46bb1019bfa8b8330ae81a1a134e08511
- https://github.com/discourse/discourse/releases/tag/v2026.1.5
- https://github.com/discourse/discourse/releases/tag/v2026.4.2
- https://github.com/discourse/discourse/releases/tag/v2026.5.1