CVE-2026-24742: Discourse Information Disclosure Flaw

CVE-2026-24742 Overview

CVE-2026-24742 is an Improper Authorization vulnerability affecting Discourse, an open source discussion platform. This vulnerability allows non-admin moderators to view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles.

Critical Impact
Non-admin moderators can bypass intended access controls and extract confidential data including webhook secrets, which could be leveraged to spoof webhook events to integrated services.

Affected Products

Discourse versions prior to 3.5.4
Discourse versions prior to 2025.11.2
Discourse versions prior to 2025.12.1
Discourse versions prior to 2026.1.0

Discovery Timeline

2026-01-28 - CVE CVE-2026-24742 published to NVD
2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-24742

Vulnerability Analysis

This vulnerability stems from improper authorization controls (CWE-863) within the Discourse platform's staff action logging system. The staff action logs are designed to provide audit trails for administrative activities, but the access control implementation fails to properly differentiate between administrator and moderator privilege levels.

When a moderator accesses the staff action logs, the system does not filter out administrator-only information, resulting in unauthorized exposure of sensitive configuration data. This includes webhook secrets, API credentials, and private communication content that moderators should not have visibility into.

The attack requires authenticated network access with moderator privileges. While moderators are trusted users with elevated permissions, they are explicitly not meant to have access to the full administrative data exposed through this flaw. The vulnerability does not require user interaction and can be exploited simply by navigating to and viewing the staff action logs interface.

Root Cause

The root cause is Improper Authorization (CWE-863) in the staff action log access control mechanism. The Discourse application fails to implement proper role-based access control checks when rendering staff action log entries. Instead of filtering log entries and their contents based on the viewer's actual permission level (administrator vs. moderator), the system exposes all administrative log data to any user with staff-level access.

Attack Vector

The attack vector is network-based and requires low privileges (moderator role). An attacker who has obtained or been granted moderator status on a Discourse installation can exploit this vulnerability through the following steps:

Log in to the Discourse instance with moderator credentials
Navigate to the staff action logs section within the admin panel
View log entries that contain sensitive administrative data
Extract webhook secrets, API key information, and private content from the exposed log entries

With leaked webhook secrets, an attacker could potentially craft malicious requests that appear to originate from the Discourse platform, allowing them to spoof webhook events to any integrated third-party services. This could lead to unauthorized actions in connected systems.

Detection Methods for CVE-2026-24742

Indicators of Compromise

Review staff action log access patterns for unusual moderator activity
Monitor for moderator accounts accessing administrator-level log entries
Check for unexpected API calls or webhook activity from external sources
Audit third-party integrations for unauthorized or suspicious webhook events

Detection Strategies

Implement logging and alerting on staff action log access by user role
Monitor authentication logs for unusual moderator login patterns or session activity
Review webhook endpoint logs for requests that may indicate secret compromise
Correlate moderator access times with any anomalous administrative data exposure

Monitoring Recommendations

Deploy application-level monitoring to track access to staff action logs by permission level
Enable audit logging for all administrative interface access
Configure alerts for bulk viewing of staff action log entries
Monitor outbound webhook traffic for signs of spoofing or replay attacks

How to Mitigate CVE-2026-24742

Immediate Actions Required

Upgrade Discourse to patched versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 immediately
Rotate all webhook secrets that may have been exposed to moderators
Regenerate API keys that were visible in staff action logs
Review and audit current moderator appointments, limiting access to fully trusted users
Inspect staff action logs for evidence of unauthorized moderator access

Patch Information

The vulnerability has been patched in Discourse versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. Administrators should upgrade to one of these versions based on their deployment track. For detailed patch information and security guidance, refer to the GitHub Security Advisory.

Workarounds

Review and limit moderator appointments to fully trusted users only
Temporarily demote non-essential moderators until the patch is applied
There is no configuration-based workaround to prevent this access; upgrading is the only complete remediation

bash

# Example: Upgrade Discourse using the recommended method
cd /var/discourse
./launcher rebuild app
# Verify the version after upgrade
./launcher enter app
rails -v