A flaw in the Post Edits admin report caused the first 40 characters of raw post content from private messages and secure categories to leak to moderators who should not have that access, constituting a PRIVILEGE SEEP HACK CWE-200 information exposure and allowing unintended disclosure of confidential content.

Discourse, the open‑source discussion platform, is affected; versions prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are vulnerable, while later releases contain the fix.

The CVSS score of 2.7 indicates low severity, and the EPSS probability is less than 1%, indicating a low likelihood of exploitation. It is not listed in CISA's KEV catalog. The likely attack vector requires a moderator or an actor who can assume moderator privileges to access the /admin/reports/post_edits endpoint, thereby exposing private message snippets; no publicly disclosed exploit code is available.