Discourse's Data Explorer feature lacked an authorization check when creating QueryGroupBookmarks. This oversight lets any logged‑in user create bookmarks for query groups they do not own or have permission to view. As a result, the system can expose metadata about query group access and composition through bookmark reminder notifications, violating confidentiality. The weakness is a missing authorization guard (CWE‑862).

The problem exists in the open‑source Discourse forum platform. Versions up to, but not including, 2025.12.2, 2026.1.1, and 2026.2.0 are affected. Consequently, any site running Discourse 2025.12.1 or earlier, 2026.1.0 or earlier, or 2026.2.0‑beta versions is vulnerable. Upgrading to any of the patched releases fixes the issue. No other vendors or products are listed.

The CVSS is 1.3, indicating a low severity. EPSS is below 1%, meaning that exploitation is currently considered very unlikely. The vulnerability is not listed in the CISA KEV catalogue. Because the flaw requires a logged‑in user with access to the Data Explorer interface, an attacker would need either legitimate credentials or an active session. The lack of an authorisation guard lets the user create bookmarks for inaccessible query groups, leaking metadata through reminders. Overall, while the impact is limited to some metadata disclosure, the risk level remains low, and widespread exploitation is not currently reported.