The flaw in Discourse causes whispered posts—messages meant only for whisperers—to appear in excerpt snippets that are visible to all participants. This creates a confidentiality breach, allowing unauthorized viewers to read content that should be restricted, which is a classic information‑disclosure weakness (CWE‑200). The vulnerability is triggered by the way the system compiles nearby posts for excerpts, returning all posts without filtering for whisper status.

Discourse, the open‑source forum platform, is affected. All releases prior to 2025.12.2, 2026.1.1, and 2026.2.0 contain the flaw. Users who have installed any earlier version of Discourse should plan to upgrade to at least 2025.12.2, 2026.1.1, or 2026.2.0, where the bug has been fixed.

The vulnerability has a CVSS score of 4.9, indicating moderate severity. The EPSS score is reported as less than 1%, implying a low probability of exploitation at this time. It is not included in CISA’s Known Exploited Vulnerabilities catalog. The likely attack path is through normal forum usage: a user browsing posts or viewing an excerpt will see whisper content. No special privileges are required beyond normal read access. Because the flaw is purely a disclosure issue and exploitable by any user who can trigger an excerpt, the risk remains moderate but the actual exploitation chance is low.