CVE-2026-26265: Discourse IDOR Information Disclosure Flaw

CVE-2026-26265 Overview

CVE-2026-26265 is an Insecure Direct Object Reference (IDOR) vulnerability in Discourse, an open source discussion platform. The vulnerability exists in the directory items endpoint (DirectoryItemsController#index), which allows any user—including anonymous users—to retrieve private user field values for all users in the directory. This authorization bypass enables bulk exfiltration of sensitive user data that administrators have explicitly configured as non-public.

Critical Impact

Attackers can exfiltrate private user data such as phone numbers, addresses, and other sensitive custom fields from all users in the directory without authentication.

Affected Products

• Discourse versions prior to 2025.12.2
• Discourse versions prior to 2026.1.1
• Discourse versions prior to 2026.2.0

Discovery Timeline

• 2026-02-26 - CVE-2026-26265 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26265

Vulnerability Analysis

This vulnerability stems from improper authorization (CWE-863) in the Discourse directory items API endpoint. The user_field_ids parameter in DirectoryItemsController#index accepts arbitrary user field IDs without performing authorization checks. This bypasses the visibility restrictions (show_on_profile / show_on_user_card) that are properly enforced elsewhere in the application, such as in UserCardSerializer via Guardian#allowed_user_field_ids.

The flaw allows unauthenticated attackers to make simple GET requests to the /directory_items.json endpoint with any private field ID and receive that field's value for every user listed in the directory response. This represents a significant data exposure risk as it enables bulk collection of sensitive personal information that site administrators had intentionally restricted from public view.

Root Cause

The root cause is a missing authorization check in the DirectoryItemsController#index action. While other parts of the Discourse application properly filter user field access based on the show_on_profile and show_on_user_card visibility settings through the Guardian#allowed_user_field_ids method, the directory items endpoint fails to apply this same filtering. The endpoint directly accepts and processes any user_field_ids parameter values provided in the request without validating whether the requesting user has permission to view those fields.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted GET request to the directory items endpoint with private user field IDs. The attack flow is straightforward:

1. The attacker identifies or enumerates private user field IDs configured on the Discourse instance
2. The attacker sends a GET request to /directory_items.json?period=all&user_field_ids=<id> where <id> is a private field ID
3. The server returns directory data including the private field values for all users
4. The attacker can repeat this process for multiple field IDs to exfiltrate all private user data

This vulnerability requires no special privileges or complex exploitation techniques—simple HTTP requests are sufficient to extract sensitive information. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-26265

Indicators of Compromise

• Unusual volume of requests to /directory_items.json endpoint from single IP addresses or user sessions
• Requests to the directory endpoint containing user_field_ids parameters with multiple or sequential field IDs
• Anonymous or low-privilege user sessions making repeated directory API calls
• Web server logs showing enumeration patterns against the directory items endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to flag requests to /directory_items.json with suspicious user_field_ids parameters
• Monitor access logs for patterns indicating bulk data extraction attempts against the directory endpoint
• Deploy anomaly detection to identify users or sessions making excessive API calls to directory-related endpoints
• Review audit logs for unauthorized access patterns to user profile data

Monitoring Recommendations

• Enable detailed request logging for all directory and user-related API endpoints
• Set up alerts for high-frequency requests to /directory_items.json from unauthenticated sources
• Monitor for sequential or enumerated access patterns in the user_field_ids parameter
• Conduct periodic reviews of access logs focusing on directory endpoint usage patterns

How to Mitigate CVE-2026-26265

Immediate Actions Required

• Upgrade Discourse to version 2025.12.2, 2026.1.1, or 2026.2.0 immediately
• Review access logs for evidence of prior exploitation attempts against the directory items endpoint
• Audit private user fields for any sensitive data that may have been exposed
• Notify affected users if evidence of data exfiltration is discovered

Patch Information

The vulnerability has been patched in Discourse versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix implements proper filtering of the user_field_ids parameter against UserField.public_fields for non-staff users before building the custom field map. This ensures that private fields configured with show_on_profile or show_on_user_card set to false are no longer accessible through the directory items endpoint.

For complete details on the security patch, refer to the GitHub Security Advisory.

Workarounds

• Disable the user directory feature entirely via the enable_user_directory site setting if upgrading is not immediately possible
• Remove sensitive data from private user fields temporarily until the patch can be applied
• Implement network-level access controls to restrict access to the /directory_items.json endpoint
• Deploy WAF rules to block requests containing user_field_ids parameters from unauthenticated users

If immediate patching is not feasible, administrators should disable the user directory feature:

# Access Discourse admin panel and disable user directory
# Navigate to: Admin > Settings > Users
# Set enable_user_directory to false

# Alternatively, use the Rails console:
# cd /var/discourse
# ./launcher enter app
# rails c
# SiteSetting.enable_user_directory = false