CVE-2026-30891: Discourse Information Disclosure Flaw

CVE-2026-30891 Overview

CVE-2026-30891 is an authorization bypass vulnerability affecting Discourse, the popular open-source discussion platform. This security flaw allows authenticated users to access the private activity of other users due to insufficient authorization checks in the user actions endpoint. The vulnerability represents a significant privacy concern for Discourse deployments, as it enables unauthorized access to user behavior data that should be restricted.

Critical Impact
Authenticated attackers can view private user activity data belonging to other users, potentially exposing sensitive information about user interactions, posts, and engagement patterns across the platform.

Affected Products

Discourse versions prior to 2026.3.0-latest.1
Discourse versions prior to 2026.2.1
Discourse versions prior to 2026.1.2

Discovery Timeline

2026-03-20 - CVE-2026-30891 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-30891

Vulnerability Analysis

This vulnerability stems from a broken access control issue (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) in the Discourse platform's user actions endpoint. The flaw exists because the application fails to properly verify that the requesting user has authorization to view another user's private activity data before returning the information.

In web applications, user activity endpoints typically return information about a user's actions—such as posts created, topics viewed, likes given, and other engagement metrics. When proper authorization controls are missing, a low-privileged authenticated user can manipulate requests to access activity data belonging to any user on the platform.

The network-accessible nature of this vulnerability means it can be exploited remotely by any authenticated user with basic platform access, requiring no special privileges or complex attack chains.

Root Cause

The root cause of CVE-2026-30891 is insufficient authorization checks in the user actions endpoint. The application accepts requests for user activity data without properly validating whether the requesting user has permission to view the target user's private information. This represents a horizontal privilege escalation vulnerability where users can access data belonging to other users at the same privilege level.

Attack Vector

The vulnerability is exploitable over the network by authenticated users. An attacker with a valid account on a vulnerable Discourse instance can craft API requests to the user actions endpoint, specifying a target user identifier different from their own. Due to the missing authorization validation, the server returns the target user's private activity data without restriction.

The attack requires low privileges (a standard authenticated account) and no user interaction from the victim, making it straightforward to exploit at scale. An attacker could systematically enumerate user IDs to harvest private activity data from all users on a Discourse instance.

For technical details regarding the specific endpoint and exploitation mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-30891

Indicators of Compromise

Unusual volume of requests to user actions API endpoints from a single authenticated session
API requests where the authenticated user ID differs from the target user ID in the request parameters
Sequential or enumerated user ID patterns in requests to activity endpoints
Access logs showing a user repeatedly querying activity data for multiple different users

Detection Strategies

Implement application-level logging for all user actions endpoint requests, capturing both the authenticated user and the requested target user
Configure web application firewalls to alert on rapid sequential requests to user activity endpoints
Deploy anomaly detection to identify users accessing activity data for an unusually high number of other accounts
Review access logs for patterns indicative of user enumeration or data harvesting activities

Monitoring Recommendations

Enable verbose logging on Discourse application servers to capture API request details including authentication context
Set up alerts for spikes in user actions endpoint traffic that deviate from baseline patterns
Monitor for authenticated sessions making requests across many different user profiles in short time windows
Regularly audit access logs for evidence of unauthorized cross-user data access attempts

How to Mitigate CVE-2026-30891

Immediate Actions Required

Upgrade Discourse installations to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later immediately
Review access logs for evidence of exploitation prior to patching
Consider notifying users if evidence suggests their private activity may have been accessed
Audit any custom plugins or integrations that interact with user activity endpoints

Patch Information

Discourse has released patched versions that address this authorization bypass vulnerability. The fix implements proper authorization checks to ensure users can only access their own private activity data through the user actions endpoint. Organizations should upgrade to one of the following patched versions:

2026.3.0-latest.1 (latest release track)
2026.2.1 (stable release track)
2026.1.2 (stable release track)

For complete patch details and upgrade instructions, refer to the Discourse Security Advisory on GitHub.

Workarounds

If immediate patching is not possible, consider temporarily restricting access to the Discourse instance to trusted users only
Implement network-level access controls to limit who can reach the application while awaiting the patch deployment
Review and harden any reverse proxy or WAF rules to add additional validation on user activity endpoint requests
Monitor closely for suspicious activity patterns until the patch can be applied

bash

# Example: Update Discourse using the launcher script
cd /var/discourse
git pull
./launcher rebuild app