Discourse allows adding members through the Chat::AddUsersToChannel routine, but before version 2025.12.2, 2026.1.1, and 2026.2.0 the routine ignores a user’s blocked, ignored, or muted settings. This means an authenticated user can create a direct‑message channel with recipients who have explicitly chosen not to receive messages from them, thereby violating privacy preferences and potentially exposing sensitive or unwanted content. The CVSS score of 1.3 indicates a low severity impact, but the incident can lead to annoyance or privacy breaches for the affected users.

The vulnerability affects installations of the open‑source Discourse discussion platform running any release older than 2025.12.2, 2026.1.1, or 2026.2.0. These versions include the source code that implements the Chat::AddUsersToChannel functionality and are identified in the CPE list by the company name and product name "Discourse".

The exploit requires an authenticated user with permission to add members to a channel. Based on the description, it is inferred that the attacker must have access to the Chat::AddUsersToChannel API and sufficient channel‑management rights, which are not generally granted to all users. The EPSS score of less than 1% points to a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The overall risk is therefore modest, focusing primarily on privacy violations rather than system compromise.