A flaw in the post revision serializer of older Discourse releases caused hidden revisions to be included in the visible diff output. The only required condition is that a user accesses the diff between adjacent revisions, which is a normal feature for any forum member. Because hidden revisions contain content that is meant to be confidential, the bug leads to unintended disclosure of private information. This is an information‑exposure weakness identified as CWE‑200 and represents a direct breach of confidentiality for any user who can view the diff.

The vulnerability affects every deployment of Discourse releases older than 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. All such installations contain the unpatched core code; the issue is not limited to specific plugins or custom configurations.

The CVSS score of 5.3 classifies the issue as moderate severity, while the EPSS score of less than 1 percent indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no large‑scale exploitation is reported. The likely attack vector is trivial: any user who can view the diff between two posts can trigger the API that returns hidden revisions. Consequently, attackers can gain unauthorized access to concealed content with no special privileges, making this a risk that should be remediated promptly.