VulnSocial

CVE-2026-24742Disclosure(discourse / discourse)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This allows moderators to bypass intended access controls and extract confidential data by monitoring the staff action logs. With leaked webhook secrets, an attacker could potentially spoof webhook events to integrated services. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site administrators should review and limit moderator appointments to fully trusted users. There is no configuration-based workaround to prevent this access.

discourse CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-01-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
discourse
Products
discourse

2 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-01-28: 1Mentions · 2026-01-29: 1Technical Details · 2026-01-28: 1Technical Details · 2026-01-29: 101-2801-29
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-24742 Information Disclosure Vulnerability in Discourse Staff Action Logs Before 3.5.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24742

    Post summary

    The text announces CVE-2026-24742 as an information disclosure vulnerability affecting Discourse prior to version 3.5.4, without providing details on exploitation or remediation.

    1000066
    4.0K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-24742 Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information i… https://www.cve.org/CVERecord?id=CVE-2026-24742

    Post summary

    The post announces a new CVE (CVE‑2026‑24742) affecting Discourse, noting a data‑disclosure flaw in older versions, with no mention of PoCs, exploits, or patches.

    00000161
    56.5K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2025.12.0--
Appdiscoursediscourse2026.1.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities