Staged users in Discourse can set custom data fields that, due to a flaw, are displayed on public invitation pages even before the user has verified their email address. This leaks sensitive personal information and usernames to anyone who visits the invite page, creating a privacy breach without needing to authenticate. The weakness is captured by CWE‑200. The primary consequence is the accidental exposure of user data, potentially aiding social‑engineering or profiling attempts.

Discourse installs running the 2026.1 series between versions 2026.1.0 and 2026.1.2, the 2026.2 series between 2026.2.0 and 6.2.1, and any 2026.3.0 build prior to the patched 2026.3.0 release are impacted. All other 2026.x releases are unaffected.

The CVSS score of 2.7 indicates a low severity issue. Exploitation does not require special privileges; an attacker only needs to view a public invitation link, a scenario that is very likely in typical usage. Because no exploitation code has been found publicly and the vulnerability does not allow further escalation, the risk to system integrity is limited. The EPSS score of < 1% indicates a very low probability of exploitation, and its absence from CISA’s KEV catalog means it is not known to be actively exploited in the wild.