The vulnerability in the chat plugin allows users with read‑only category permissions to initiate chat threads, and lets participants restore deleted messages after channel access is revoked. Moderators reviewing flagged content are exposed to the last message of the channel, which may be unrelated direct‑message content. Calendar event payloads also expose the chat channel and its last message to anyone able to view the event, including anonymous visitors. These weaknesses, classified as CWE‑200 and CWE‑862, result in unauthorized disclosure of chat data and elevated permissions that can be abused by individuals with limited roles.

Affected applications are Discourse versions 2026.1.0 through just before 2026.1.4, 2026.3.0 through just before 2026.3.1, and 2026.4.0 through just before 2026.4.1. The problem exists on sites that have the chat plugin enabled, and in the case of the calendar issue also requires the discourse‑calendar plug‑in. The patches that address all four issues are present in 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0.

The CVSS score is 5.3, indicating moderate severity. The EPSS score is less than 1%, suggesting few exploit attempts have been observed. The vulnerability is not listed in CISA’s KEV catalog. Attackers are likely to benefit from the ability to create chat threads as read‑only users or to restore messages, providing a pathway for further privilege escalation or reconnaissance within the chat environment. Preventing exploitation requires applying the vendor‑issued patch or disabling the vulnerable plugins.