CVE-2026-53960: Medium severity Discourse vulnerability
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.6 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53960?
CVE-2026-53960 has a medium severity score of 5.3 based on CVSS 3.1.
How do I fix CVE-2026-53960?
To fix CVE-2026-53960, upgrade your Discourse installation to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
What type of data is exposed by CVE-2026-53960?
CVE-2026-53960 exposes hidden or unviewable first-post content as an excerpt in publicly-served Q&A JSON-LD structured data.
Who is affected by CVE-2026-53960?
Any Discourse installation prior to the patched versions listed in CVE-2026-53960 is affected.
What can unauthorized users access due to CVE-2026-53960?
Unauthorized users can access sensitive data that was meant to be hidden, as it is exposed to any unauthenticated visitor.