The flaw allows users who can view a group’s posts but have no permission to view shared drafts to receive serialized shared-draft data through the group posts and mentions endpoints. This leaks the title and excerpt of unpublished draft topics, exposing confidential, unpublished content. The weakness arises from missing authorization checks, mapped to CWE‑862.

The vulnerability affects the Discourse discussion platform. All releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are vulnerable. The issue is fixed in those four releases, so any installation of Discourse running an earlier version is potentially exposed.

The CVSS score is 4.3, indicating moderate risk. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, which suggests it is not widely exploited. The likely attack vector is remote, inferred from the description, and requires only the ability to access group posts; no privileged escalation is needed. An attacker who can view group activity but not drafts could harvest titles and snippets of unpublished drafts, leading to confidentiality compromise of draft material.