Discourse, an open‑source discussion platform, had an issue in the implementation of its /private‑posts endpoint. Prior to certain patches, the endpoint did not limit its results based on post type visibility, allowing users participating in a private message thread to view whisper posts—content intended only for designated participants—alongside normal messages. This weakness results in unauthorized disclosure of private content, classifying it as an information‑disclosure vulnerability.

The vulnerability impacts the Discourse community edition. Versions lower than 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are affected. The patching fixes explicitly add the necessary visibility filtering. All users running earlier releases should consider them vulnerable until the fix is applied.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a low likelihood of active exploitation. The issue is not listed in the CISA KEV catalog, implying no known large‑scale exploits. Attackers need only authenticated accounts with access to the private‑message thread and can retrieve the whisper posts simply by querying the affected endpoint. Although the exploit is straightforward for a legitimate thread participant, it does not provide broader privileges or remote code execution.