The vulnerability in Discourse allows an authenticated user to access another user's private activity through the user actions endpoint due to insufficient authorization checks. This results in a confidentiality breach where sensitive personal interactions or actions can be exposed to attackers. The weakness is a classic information disclosure flaw, aligning with CWE-200.

The affected product is the Discourse discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 are vulnerable. The official patch is included in those three releases, restoring proper authorization controls.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog, further indicating a low threat level. Attackers would need to compromise or impersonate a legitimate user to leverage the API endpoint, making the vector remote but dependent on valid credentials. No known public exploits are reported, and the weak exposure does not provide direct code execution or denial of service capabilities.