In the open‑source Discourse discussion platform, an excessively permissive authorization check on the deleted‑posts index endpoint allows a non‑staff user with certain elevated group memberships to view any user's deleted posts. The flaw, classified under CWE‑863, results in the disclosure of content that administrators intended to keep private, compromising the confidentiality of deleted discussions.

All Discourse installations running versions earlier than 2026.3.0‑latest.1, 2026.2.1, or 2026.1.2 are affected. The patched releases—2026.3.0‑latest.1, 2026.2.1, and 2026.1.2—contain a fix that tightens the permission model and removes the vulnerability.

The CVSS score of 4.9 denotes moderate severity, while the EPSS score of less than 1 % suggests that widespread exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The attacker can exploit the flaw by sending a request to the /posts/deleted endpoint; this attack vector is inferred from the description, as the vulnerability is described as an “overly broad authorization check.” The impact is primarily the unauthorized disclosure of deleted content, with risk level depending on the sensitivity of the data that has been removed.