Discourse’s MessageBus calculation incorrectly allows an authenticated user who can view a restricted category but cannot use Chat to receive live or recent chat messages from that category. The flaw does not enable message creation or full history retrieval, but it exposes private discussion content that should remain confidential. The vulnerability is a confidentiality breach of chat content but does not compromise system integrity or availability.

Discourse platform versions released before 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 are impacted. Any installation running those releases can deliver restricted chat messages to users outside the intended chat‑eligible group.

With a CVSS score of 7.5 this issue is high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation at the moment, and the flaw is not listed in CISA KEV. The likely attack vector is an authenticated user who can view a category but is denied chat access. No special code execution is required; the attacker simply receives messages that should have been hidden. The impact is confined to confidentiality loss of chat content, not to system compromise.