CVE-2026-27935
Discourse leaks private topic metadata to non-authorized users
概要
Discourse leaks private topic metadata to non-authorized users
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Discourse is an open-source discussion platform. Versions prior to 2026.3.0, 2026.2.1, and 2026.1.2 have a vulnerability in an API endpoint that discloses private topic metadata of admin users to moderator users even if the moderators do not have access to the private topics. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
Bitnami
discourse
[{"type":"SEMVER","events":[{"introduced":"2026.1.0"},{"fixed":"2026.1.2"},{"introduced":"2026.2.0"},{"fixed":"2026.2.1"},{"introduced":"2026.3.0"},{"fixed":"2026.4.0"}]}]
参照URL
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- web nvd.nist.gov