Discourse AI Reviewable Disclosure in Private Messages (v<2026.1.6)
CVE-2026-84302 Published on September 24, 2026
Discourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Vulnerability Analysis
CVE-2026-84302 is exploitable with network access, requires user interaction and user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-84302 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-84302
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2026.7.0 is affected.
- Version >= 2026.6.0-latest, < 2026.6.1 is affected.
- Version >= 2026.5.0-latest, < 2026.5.2 is affected.
- Version >= 2026.1.0-latest, < 2026.1.6 is affected.