An API endpoint in the open‑source discussion platform exposes private topic metadata belonging to administrators. The flaw allows moderators, who normally lack permission to view those private topics, to obtain sensitive metadata. This represents a privacy violation, classified as CWE‑201, without enabling further exploit such as code execution or system compromise.

Discourse releases before 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are affected. Upgrading to any of those patched versions removes the vulnerability.

The CVSS base score of 6.9 indicates a moderate severity, while the EPSS score below 1% suggests a low probability of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated: a legitimate moderator can invoke the exposed API and receive unauthorized private topic metadata without needing higher privileges.