The ComposerController#mentions endpoint in Discourse is vulnerable to an information‑exposure flaw. Authenticated users who can message a hidden group can query the endpoint with an allowed_names parameter referencing that group. By probing arbitrary usernames, an attacker learns whether a given user is listed as a member when user_reasons returns "private", allowing the attacker to infer hidden membership without direct visibility. The flaw enables the disclosure of group membership to unauthorized users, exposing internal structure for social engineering or targeted attacks. The weakness corresponds to Information Exposure (CWE‑200) and Authorization Bypass (CWE‑285).

Discourse discussion platform, all releases older than 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are affected. The security patch was back‑ported to those releases and higher, so upgrading to at least these versions removes the vulnerability. Discourse 2026.3.0‑latest.1 or newer includes the fix.

The CVSS base score is 5.3, a medium severity rating that reflects the restricted scope of the impact. EPSS is below 1%, indicating a low probability of exploitation in the wild at present. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is an authenticated user who can send messages to the hidden group, which they can then exploit by performing a controlled request to the Composer mentions endpoint. Exploitation requires no special privileges beyond normal messaging permissions and thus represents a moderate operational risk for organizations that rely on hidden group membership for confidentiality.