A restriction bypass in Discourse allows the disclosure of restricted post‑action counts to users who do not have the required privileges, enabling them to see metadata that should remain confidential. The weakness is an Authorization Bypass described by CWE-863, leading to unauthorized exposure of user activity data.

The affected product is the Discourse open‑source discussion platform. Versions earlier than 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are vulnerable. Users running these releases should verify their installation and upgrade if possible.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests a low predicted probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves sending a crafted HTTP request to a Discourse endpoint; no privileged access is required to benefit from the disclosure.