A logic flaw in early 2026 releases of Discourse allowed moderators who were not participants in a private message to see and modify the message through the AI review queue. The flaw bypassed reviewable visibility filtering, letting an authenticated moderator read confidential content and, depending on the review action, close the related topic or delete a post. The vulnerability is identified as a flaw that permits read and write of otherwise protected data.

Discourse core, specifically versions released before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The issue applies when Discourse AI reviewables are enabled for private messages. Only users with moderator privileges and active reviewables can exploit it; end‑users or anonymous visitors are unaffected.

The CVSS score of 4.2 indicates low severity, and the vulnerability is not flagged in CISA’s KEV catalog. EPSS data is currently unavailable. An attacker must first have a legitimate moderator account and trigger an AI reviewable tied to a private message; once that condition is met the moderator can read or delete the content. Because the attack vector relies on an authenticated role and a specific reviewable configuration, the likelihood of widespread exploitation appears limited, but the confidentiality impact on private conversations is significant.