The vulnerability arises from insufficient authorization checks in the discourse-user-notes component, allowing a moderator to retrieve metadata for posts they should not be able to view. This results in the unintended disclosure of private post information, exposing users' content and administrative data. The weakness is directly mapped to a missing authorization failure (CWE‑862).

Discourse, the open‑source discussion platform, is affected in releases preceding 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2. Authenticated moderators in these versions can exploit the flaw. All other Discourse versions later than the mentioned releases include the security fix.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score below 1% suggests a low likelihood of public exploitation. The vulnerability has not been listed in CISA's KEV catalog. Exploitation requires an existing moderator account and careful navigation of the note endpoints; no external network or privilege escalation is necessary. Organizations should assess whether moderators have broader permissions than required and ensure patching.