CVE-2026-31869: Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowednames referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether userreasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31869?
CVE-2026-31869 has a severity rating that indicates it poses a significant risk of exposing hidden group memberships.
How do I fix CVE-2026-31869?
To fix CVE-2026-31869, upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.
Who is affected by CVE-2026-31869?
Users running Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 are affected by CVE-2026-31869.
What type of vulnerability is CVE-2026-31869?
CVE-2026-31869 is a vulnerability related to information disclosure in the Composer mentions endpoint of Discourse.
Can CVE-2026-31869 lead to data leaks?
Yes, CVE-2026-31869 can lead to data leaks by revealing hidden group membership through an unauthorized check.