Discourse, an open-source discussion platform, had a flaw that allowed users with moderator privileges to export other users’ private chat messages as CSV files. The defect stemmed from an overly permissive allowlist in the `can_export_entity?` method; rather than restricting export to only explicitly allowed entities, the logic permitted any entity that was not explicitly blocked. As a result, moderators could retrieve sensitive private conversations, violating confidentiality and exposing potentially personal data.

The vulnerability affected all Discourse installations running versions earlier than 2025.12.2, 2026.1.1, or 2026.2.0. These include binaries and source releases that match the Discourse CPE names identified in the advisory. Patch versions 2025.12.2, 2026.1.1, and 2026.2.0 include the fix.

The CVSS score of 1.3 reflects the low severity, and an EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The issue does not appear in the CISA KEV catalog. Exploitability requires legitimate moderator access to the site; one would use the CSV export endpoint after authenticating as a moderator or higher role. No external attack vector or additional prerequisites are documented, so the risk is confined to sites where moderators have trusted roles.