Discourse is an open-source discussion platform that inadvertently exposed the title and post excerpt of private topics through its user-action API endpoint. The flaw occurs because the API does not enforce visibility checks, so any user can retrieve that sensitive data. The result is an information disclosure that could surface private discussion details to unauthorized parties. This weakness aligns with CWE-201, an information exposure vulnerability.

The vulnerability affects all Discourse releases older than 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Administrators running those versions are at risk of leaking private topic data. The CPE list confirms that the issue exists in the core product across all platform flavors until the mentioned patches.

The security score is 8.7, indicating a high severity. The EPSS probability is less than 1 %, suggesting that few public exploits are known at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack path is an unauthenticated or insufficiently privileged user sending a crafted request to the user-action API endpoint, which then returns the title and excerpt of a private topic. No public exploit code is publicly documented, but the flaw’s simplicity means it could be abused by a determined adversary through normal API usage.