Discourse - Information Disclosure (CVE-2026-27934)
Description
Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have a lack of visibility checks with a user action API endpoint that results in disclosure of the title and post excerpt to unauthorized users, leading to information disclosure. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
psychologyCrowdSec Analysis
CVE-2026-27934 is an information disclosure vulnerability in Discourse caused by missing visibility checks in a user action API endpoint. Unauthenticated remote attackers may access discussion titles and post excerpts that should be restricted, potentially exposing sensitive content; upgrade to a patched version (2026.1.2, 2026.2.1, or 2026.3.0-latest.1) to address the flaw.
CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-27934 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers target /user_actions/{id}.json with numeric user-action IDs to access action data without authentication. Successful exploitation can disclose private post titles and excerpts.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-03-19 |
| Rule Released | 2026-10-20 |