CVE-2026-30891: Discourse hasUnauthorized Exposure of Private User Action Types

Q: What is the severity of CVE-2026-30891?

CVE-2026-30891 is considered a medium severity vulnerability due to unauthorized exposure of private user actions.

Q: How do I fix CVE-2026-30891?

To fix CVE-2026-30891, upgrade to Discourse version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.

Q: What are the affected versions for CVE-2026-30891?

CVE-2026-30891 affects all Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.

Q: What type of vulnerability is CVE-2026-30891?

CVE-2026-30891 is classified as an unauthorized access vulnerability, allowing users to view private activities of other users.

Q: Can CVE-2026-30891 be exploited remotely?

Yes, CVE-2026-30891 can be exploited remotely by unauthorized users accessing specific endpoints.

Published Mar 20, 2026

Updated

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a user could access another user's private activity due to insufficient authorization checks in the user actions endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

Affected Software

4 affected components

Discourse Discourse<2026.3.0-latest.1, <2026.2.1, <2026.1.2

Discourse Discourse>=2026.1.0<2026.1.2

Discourse Discourse>=2026.2.0<2026.2.1

Discourse Discourse=2026.3.0

Event History

Mar 20, 2026

CVE Published

via MITRE·03:02 AM

Data Sourced

via MITRE·03:02 AM

DescriptionWeakness

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-30891?

CVE-2026-30891 is considered a medium severity vulnerability due to unauthorized exposure of private user actions.

How do I fix CVE-2026-30891?

To fix CVE-2026-30891, upgrade to Discourse version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.

What are the affected versions for CVE-2026-30891?