# CVE-2026-59829: Discourse information disclosure in category group moderation review queue

Source: https://junglewise.ai/threats/cve-2026-59829-discourse-information-disclosure-in-category-group-moderation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59829 · Severity: medium · CVSS 4.3 · Published 2026-08-17

Discourse, an open-source discussion platform, leaked private message excerpts in the moderation review queue to unauthorized category moderators. Moderators could view limited excerpts of flagged private messages they were not participants in and should not have access to, compromising the confidentiality of moderation discussions. The vulnerability is limited to information disclosure only—no data can be modified or deleted—and has been patched in recent versions.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-59829 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59829 being exploited in the wild.

**How severe is CVE-2026-59829?** Medium severity, with a CVSS score of 4.3, published 17 August 2026.

**Which products and versions are affected?** Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.

**Is there a fix for CVE-2026-59829?** A patch was published on 2026: Multiple patch versions released: 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59829 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59829?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an information disclosure flaw in Discourse's category group moderation system. When flags generate notify_moderators private messages, the review queue could include excerpts and permalinks of these messages even when the reviewing category moderator was not a participant and not part of the moderation group at the time the flag was raised. The root cause involves improper access control checks in the review queue display logic for flagged messages. Attack precondition: the site must have category group moderation enabled, and an attacker must have the role of category moderator. The impact is limited to reading restricted text excerpts; message content cannot be modified or deleted. Patches are available in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.

## Affected products

- Discourse Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1

## Timeline

- 2026-08-17: disclosed
- 2026: patched: Multiple patch versions released: 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1

## References

- [https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59](https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59)
- [https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754](https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)