The vulnerability is an Insecure Direct Object Reference in Discourse's directory items endpoint. The parameter user_field_ids can be set to any custom field id without authorization checks, allowing any user—including anonymous users—to obtain the values of private custom fields for all users. This results in bulk exfiltration of sensitive information such as phone numbers, addresses, or other data that administrators have configured as non‑public.

Affected systems are installations of the Discourse discussion platform running any version prior to 2025.12.2, 2026.1.1, or 2026.2.0. These versions expose the directory items API without filtering private custom field identifiers. The problem has been addressed in the three mentioned releases and in any later releases.

The CVSS score is 7.5, indicating a high‑to‑medium severity. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. An attacker does not need special privileges, as the endpoint is accessible to all users; thus the attack vector is simple over HTTP. If exploited, the attacker can bulk exfiltrate private user data, compromising confidentiality across the entire user base.