Discourse has a flaw that publishes chat events for public channels to the MessageBus without verifying that the subscriber is authorized for chat. The result is that any client listening to the MessageBus can receive potentially sensitive chat payloads. The weakness is a classic information‑disclosure vulnerability (CWE‑200).

The affected product is the Discourse discussion platform. Vulnerable releases include 2026.1.0 through 2026.1.3, 2026.3.0 exclusively, and 2026.4.0 exclusively. These ranges are patched in 2026.1.4, 2026.3.1, 2026.4.1, and in all releases thereafter such as 2026.5.0.

The CVSS score of 7.5 labels the issue as high severity, but the EPSS score of less than 1% indicates a very low likelihood of active exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no recorded real‑world exploits. Attackers can exploit it by subscribing to the MessageBus endpoint, which is publicly reachable; no special credentials are required beyond the ability to connect to the bus. The exposure is purely informational, with no direct path to code execution or service disruption.