The vulnerability allows disclosure of Whisper translation audit logs through bot debug endpoints. Attackers can retrieve logs that may contain sensitive user messages and user identifiers, resulting in the exposure of conversation content and user identities. This is an information‑disclosure issue classified as CWE‑200.

Discourse installations running 2026.1.0 up to before 2026.1.4, 2026.3.0 up to before 2026.3.1, and 2026.4.0 up to before 2026.4.1 are affected. The patch is applied in releases 2026.1.4, 2026.3.1, 2026.4.1, and any newer 2026.5.0 versions.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % and absence from the KEV catalog suggest a low likelihood of exploitation. The exposed audit logs can provide attackers with sensitive conversation content and user identifiers. Based on the description, it is inferred that the bot debug endpoints are reachable via standard HTTP requests without additional authentication; an attacker who can reach the Discourse instance can issue such requests and download the sensitive logs. The vulnerability does not require privilege escalation, making the exposure widely available to any network‑connected user.