A vulnerability in the Discourse discussion platform allows a user whose access to a private message topic has been revoked to re‑gain access through invite links, exposing confidential conversations that should remain private. The weakness is a failure in authentication after a privilege change, formally identified as CWE‑863. Once the revoked user obtains or retains an invite URL, the system permits view or interaction with the hidden topic, constituting a confidentiality breach.

The issue impacts the open‑source Discourse platform. Versions prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 are vulnerable. The patch is included in those releases; all earlier releases within the same branches remain at risk.

The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker possess an invitation link and keep it after their access has been revoked; using the link grants immediate read access to the private topic.