An access control flaw in Discourse’s sentiment‑analytics endpoint allows an authenticated user with moderator privileges to read posts, topic titles, and usernames in categories that should be restricted. This bypasses normal category permissions and leads to confidential content being exposed to users without proper authorization. The weakness is a classic information‑leak vulnerability (CWE‑284), providing attackers with potential insight into private discussions or sensitive data.

Discourse software versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and any 2026.3.0 release before the 2026.3.0 patch are vulnerable. The issue was fixed in 2026.1.3, 2026.2.2, and 2026.3.0. Administrators should verify their installed version and consult the vendor’s advisory for exact upgrade instructions.

With a CVSS score of 5.1, the problem is considered moderate severity; exploitation requires a valid moderator account, so the attack surface is limited to users with elevated privileges. No publicly known exploits were reported and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, because it compromises confidentiality, prompt patching is recommended once an updated version is available.