The flaw allows moderators to export CSV data from reports that are limited to admins only. This bypasses the intended visibility restrictions and can expose sensitive operational data, potentially revealing user activity logs or internal metrics. The weakness is a confidentiality breach, classified as CWE‑200.

Discourse, the open‑source discussion platform, is affected. Vulnerable versions include 2026.1.0 up to but not including 2026.1.3, 2026.2.0 up to but not including 2026.2.2, and 2026.3.0 up to but not including 2026.3.0. Versions 2026.1.3, 2026.2.2, and 2026.3.0 and newer contain the fix.

The CVSS base score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user with moderator privileges to trigger the export feature; thus the attack vector is internal or through legitimate moderator access. The impact remains confined to the data that moderators can access, but the exposure of admin‑restricted content increases the risk of data leaks.