A hidden or otherwise unviewable first‑post content in Discourse is incorrectly included as an excerpt in the JSON‑LD structured data for Q&A pages. This allows any unauthenticated visitor, including search‑engine crawlers, to retrieve content that should otherwise be protected or invisible to the public. The vulnerability results in the disclosure of potentially sensitive initial post information but does not provide an avenue for privilege escalation or code execution.

The flaw affects the Discourse discussion platform. Versions released before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 contain the bug. Any deployment using these releases is at risk.

The CVSS vector indicates a moderate severity score of 5.3. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by simply requesting the QAPage JSON‑LD resource, an unauthenticated action, which exposes hidden first‑post content. The impact is limited to information disclosure, with no known path to further compromise the system.