CVE-2026-34947: Discourse: Staged user custom fields are exposed on public invite pages
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.1.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.2.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34947?
The severity of CVE-2026-34947 is classified as low with a CVSS score of 4.0.
How does CVE-2026-34947 affect Discourse users?
CVE-2026-34947 allows staged user custom fields and usernames to be exposed on public invite pages without email verification.
Which versions of Discourse are impacted by CVE-2026-34947?
Discourse versions from 2026.1.0 to before 2026.1.3, from 2026.2.0 to before 2026.2.2, and from 2026.3.0 to before 2026.3.0 are affected by CVE-2026-34947.
How can I fix the vulnerability CVE-2026-34947?
To fix CVE-2026-34947, update Discourse to the latest version that is not affected by this vulnerability.
What type of vulnerability is CVE-2026-34947?
CVE-2026-34947 is classified as an information leakage vulnerability.