Moderators can create Zendesk tickets for topics they cannot view, allowing private or restricted forum content to be sent to Zendesk. This is a classic authorization bypass (CWE‑863) that permits privileged users to expose confidential information that should remain hidden. The flaw stems from a missing access check during ticket creation, leading to direct data exposure over an external ticketing system.

Discourse forums running any version prior to 2026.3.0‑latest.1, 2026.2.1, or 2026.1.2 that have the Zendesk plugin installed are affected. The vulnerability applies to all forums where moderators have the ability to create Zendesk tickets, regardless of topic visibility.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score below 1% suggests a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers who are moderators can exploit it by simply using the Zendesk ticket creation interface, which then sends topic data to Zendesk even when the moderator lacks viewing rights. This results in unintended disclosure of private forum content to an external system.