CVE-2026-21865

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages to public topics when they shouldn't have access. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site admin can temporarily revoke the moderation role from untrusted moderators or remove the moderator group from the "personal message enabled groups" site setting until the Discourse instance has been upgraded to a version that has been patched.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/discourse/discourse/security/advisories/GHSA-4777-wrv5-3g39	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:::::stable:::*
	cpe:2.3:a:discourse:discourse:2025.12.0::::stable:::
	cpe:2.3:a:discourse:discourse:2026.1.0::::stable:::

History

No history.

Information

Published : 2026-01-28 20:16

Updated : 2026-01-30 20:30

NVD link : CVE-2026-21865

Mitre link : CVE-2026-21865

CVE.ORG link : CVE-2026-21865

JSON object : View

Products Affected

discourse

discourse

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-21865", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2026-01-28T20:16:14.530", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-4777-wrv5-3g39", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can convert some personal messages to public topics when they shouldn't have access. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site admin can temporarily revoke the moderation role from untrusted moderators or remove the moderator group from the \"personal message enabled groups\" site setting until the Discourse instance has been upgraded to a version that has been patched."}], "lastModified": "2026-01-30T20:30:18.947", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "FDBF21E2-1191-4020-A17A-0702DE4E6451", "versionEndExcluding": "3.5.4"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "539B5B85-44F0-408E-B994-08BB20EA9C26", "versionEndExcluding": "2025.11.2", "versionStartIncluding": "2025.11.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:2025.12.0:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "CCBF47A8-0D3F-4174-8084-CD3517BF272A"}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.1.0:*:*:*:stable:*:*:*", "vulnerable": true, "matchCriteriaId": "F6CF5F98-F08F-4B28-BBE2-8296760A547E"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}