Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-31869 Group Membership Disclosure Vulnerability in Discourse Prior to 2026.3.0-latest.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31869
Post summary
A group membership disclosure vulnerability in Discourse (before 2026.3.0‑latest.1) is identified, but no further details on exploitation, patching, or PoC are included.
CVE-2026-31869 Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden … https://www.cve.org/CVERecord?id=CVE-2026-31869
Post summary
The post announces CVE‑2026‑31869, noting a flaw in Discourse’s ComposerController#mentions endpoint on certain older releases, with a reference to the official CVE record.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.3.0 | - | - |