The vulnerability allows an authenticated user to read shared draft topic titles by crafting an inline onebox request with a category_id that points to the shared drafts category. Because the request bypasses proper authorization checks, the attacker can view content that should be hidden. This is a confidentiality breach and is classified under CWE-200 – Information Exposure.

Discourse mobile and web platform 2026.1.0‑latest to before 2026.1.3, 2026.2.0‑latest to before 2026.2.2, 2026.3.0‑latest to before 2026.3.0 are affected. Versions 2026.1.3, 2026.2.2, and 2026.3.0 contain the fix.

The CVSS base score of 4.3 indicates moderate severity. The vulnerability requires the user to be authenticated, which is a precondition that limits exploitability. No public exploit was published, and the vulnerability is not in the CISA KEV catalog. An attacker can likely trigger the vulnerability by sending a crafted onebox request through the web interface or API once authenticated.