An insufficient access control on a sentiment analytics endpoint in Discourse allows an authenticated moderator-level user to retrieve post content, topic titles, and usernames from categories they were not authorized to view. This flaw enables the exfiltration of confidential discussion data across category boundaries, compromising privacy and internal confidentiality.

Versions from 2026.1.0 through before 2026.1.3, 2026.2.0 through before 2026.2.2, and 2026.3.0-latest through before 2026.3.0 are vulnerable. The issue is addressed in releases 2026.1.3, 2026.2.2, and 2026.3.0 onward.

The CVSS score of 5.1 reflects moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Because it requires an authenticated moderator account, only users with elevated privileges can exploit it; therefore, the risk is primarily internal. Administrators should enforce strict role policies while applying the available fix.