Discourse versions before 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allow moderators who are not administrators to view the staff action logs. The logs reveal webhook payload URLs, secrets, API key details, site setting changes, private message content, restricted category names, and private chat channel titles. This defect bypasses the platform’s intended access controls, permitting confidential data extraction and potentially enabling attackers to forge webhook events to integrated services.

The vulnerable software is the Discourse discussion platform, specifically any instance running a version earlier than 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0. The issue is identified for the official Discourse product; no other vendors are affected.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to acquire moderator privileges or co‑operate with a moderator to exploit this flaw; no configuration‑based workaround exists, so the only mitigation is to patch or restrict moderator appointments. The vulnerability’s primary impact is information disclosure, with the potential for further exploitation if webhook secrets are leaked.