CVE-2026-34947: Discourse Information Disclosure Flaw

CVE-2026-34947 Overview

CVE-2026-34947 is an information exposure vulnerability affecting Discourse, a popular open-source discussion platform. The vulnerability allows staged user custom fields and usernames to be exposed on public invite pages without requiring email verification. This flaw could enable unauthorized actors to harvest user information from Discourse installations, potentially facilitating social engineering attacks or privacy violations.

Critical Impact

Staged user data including custom fields and usernames are exposed on public invite pages without proper email verification, allowing unauthorized information disclosure.

Affected Products

• Discourse versions 2026.1.0-latest to before 2026.1.3
• Discourse versions 2026.2.0-latest to before 2026.2.2
• Discourse versions 2026.3.0-latest to before 2026.3.0

Discovery Timeline

• 2026-04-03 - CVE-2026-34947 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2026-34947

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in the invite page functionality where staged user information is rendered without properly validating whether the requesting user has completed email verification.

When users are invited to join a Discourse forum, their accounts enter a "staged" state where certain profile information including custom fields and usernames are stored in the system. The vulnerability occurs because the public invite page endpoints fail to implement proper access controls, exposing this staged user data to anyone who can access the invite URL. This represents a failure in the principle of least privilege, where sensitive user information should only be accessible after proper authentication workflows are completed.

Root Cause

The root cause stems from insufficient access control checks in the invite page rendering logic. The application does not properly verify email confirmation status before exposing staged user profile data on public invite pages. This allows unauthenticated visitors to view information that should only be accessible after the invited user has completed the email verification process.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with access to invite page URLs could enumerate staged user information without any special privileges. The attack scenario involves:

1. An attacker obtains or guesses invite page URLs on a Discourse installation
2. The attacker accesses these invite pages without authentication
3. Staged user custom fields and usernames are exposed to the attacker
4. This information could be used for targeted phishing, social engineering, or privacy violations

Since no code examples are available for this vulnerability, refer to the GitHub Security Advisory for technical implementation details.

Detection Methods for CVE-2026-34947

Indicators of Compromise

• Unusual access patterns to invite pages from unknown IP addresses
• High volume of requests to /invites/* endpoints from single sources
• Access logs showing enumeration attempts against invite URLs
• Reconnaissance activity targeting user profile endpoints

Detection Strategies

• Monitor web server access logs for repeated requests to invite page endpoints
• Implement rate limiting alerts on public invite page access
• Configure web application firewalls to detect URL enumeration patterns
• Review authentication logs for anomalies in invite acceptance workflows

Monitoring Recommendations

• Enable detailed logging for all invite-related endpoints
• Set up alerts for bulk access to invite pages from single IP addresses
• Monitor for data exfiltration patterns in outbound traffic
• Implement anomaly detection for unusual invite page access volumes

How to Mitigate CVE-2026-34947

Immediate Actions Required

• Update Discourse to patched versions 2026.1.3, 2026.2.2, or 2026.3.0 immediately
• Review access logs for any suspicious activity targeting invite pages
• Audit staged user accounts for potential exposure of sensitive custom fields
• Consider temporarily disabling public invitations until the patch is applied

Patch Information

The Discourse development team has addressed this vulnerability in versions 2026.1.3, 2026.2.2, and 2026.3.0. Organizations running affected versions should upgrade immediately. For detailed patch information, consult the GitHub Security Advisory.

Workarounds

• Temporarily disable public invite functionality until patching is complete
• Implement additional authentication requirements for invite pages at the reverse proxy level
• Remove sensitive information from staged user custom fields as an interim measure
• Consider restricting invite page access to authenticated users only through web server configuration

# Example: Restrict access to invite pages via nginx
# Add to your Discourse nginx configuration
location ~ ^/invites {
    # Require authentication or restrict by IP
    allow 10.0.0.0/8;
    deny all;
    # Or implement basic auth as temporary measure
    # auth_basic "Restricted Access";
    # auth_basic_user_file /etc/nginx/.htpasswd;
}