This vulnerability involves two authorization lapses in the chat direct‑message API. An authenticated user can supply a hidden or private group name when creating or expanding a DM channel, and the system resolves that name without verifying the creator’s rights to view the group. Consequently the user receives a channel containing all members of the private group, leaking their identities. Additionally, the API’s check for chat ability ignores the individual user’s chat‑enabled preference, letting a chat‑disabled user create or query DM channels between other participants. The resulting channel response can expose the private last‑message content, further compromising confidentiality. The weakness is catalogued as CWE‑863: Insufficient Authorization.

The affected product is the open‑source discussion platform Discourse. Vulnerable versions are all releases prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2. Versions 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 contain the fix and are recommended for deployment.

The CVSS score of 5.4 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker needs only authenticated access to the chat API and knowledge of a private group name. The exploit path is straightforward: construct a valid API request to /direct_messages using the target_groups parameter or to query a DM channel, and read the returned data. Once executed, the attacker gains information about private group membership and potentially private last messages, compromising confidentiality but not system control.