CVE-2026-27934: Discourse leaks private topic title and post excerpt via user action API endpoint
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27934?
CVE-2026-27934 is considered a moderate severity vulnerability due to potential exposure of private information.
How do I fix CVE-2026-27934?
To fix CVE-2026-27934, upgrade to Discourse version 2026.3.0-latest.1 or later, or 2026.2.1, or 2026.1.2.
What information is leaked by CVE-2026-27934?
CVE-2026-27934 leaks private topic titles and post excerpts through a user action API endpoint.
Which versions of Discourse are affected by CVE-2026-27934?
Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 are affected by CVE-2026-27934.
What causes CVE-2026-27934?
CVE-2026-27934 is caused by a lack of visibility checks in the user action API endpoint.