The vulnerability is an authorization bypass in the Category Chatables controller show action. Moderators, who are already authenticated, can access the /category-chatables endpoint and receive metadata about hidden groups, including group names and member counts. This exposes sensitive administrative information that should be concealed, which is a classic information‑disclosure weakness (CWE‑200).

Discourse installations running any of the following versions are impacted: 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0‑earlier. The issue has been fixed in 2026.1.3, 2026.2.2, and 2026.3.0.

The CVSS score of 5.3 indicates a moderate level of risk. There is no EPSS score available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate moderator account, so while external attackers cannot directly abuse the flaw, privileged insiders could use it to learn hidden group membership and potentially track or target users within those groups.