A bug in the review queue caused a short excerpt and a permalink of private messages attached to flag notifications to be shown to moderators of a category group that had no role in the original private message. The admission of this data exposed a limited portion of the flag‑related private message content, however the vulnerability did not allow any modification or deletion of the messages. The principal effect is a breach of confidentiality for that excerpted data.

The vulnerability affects the Discourse open‑source discussion platform. Sites running Discourse versions earlier than 2026.1.6, 2026.5.2, 2026.6.1 or 2026.7.1 and that have category group moderation enabled can be impacted. No other vendors or products are listed as affected.

The CVSS score of 4.3 places the vulnerability in the moderate range; the EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating it is not known to be exploited in the wild. The likely attack vector is an authenticated moderator belonging to a category’s moderation group, who can view the review queue. Because the vulnerability only reveals a snippet of a private message and cannot alter any data, the risk is confined to confidentiality of that excerpt. Nonetheless, any user with appropriate moderator permissions could gain unintended visibility into private communication.