A missing authorization check in Discourse permits authenticated non‑staff users to view read‑receipt metadata for posts marked as staff‑only. The exposed data contains only the identities of readers and timestamps, with no post content revealed. This breach exposes communication patterns and staff engagement data, constituting a confidentiality violation limited to metadata.

Discourse deployments running versions from 2026.1.0 up to before 2026.1.3, from 2026.2.0 up to before 2026.2.2, and releases of 2026.3.0 before the 2026.3.0 patch are vulnerable. Any standard user can trigger the disclosure by accessing the whisper read‑receipt endpoints for staff‑only posts.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker must be an authenticated user with a session and must know the identifier of a staff‑only post, implying the likely attack vector is through normal web application or API requests to the whisper endpoints.