CVE-2026-59829

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.

• CWE-862

• https://github.com/discourse/discourse/commit/4df0e54f59361c78606b578ad12a2c39b4dd9f59
• https://github.com/discourse/discourse/commit/58e45dc7c92d19d5294c73fbcd3833c73dc51754
• https://github.com/discourse/discourse/commit/74c8522a197658c69b0adefa182f601ce85dcefa
• https://github.com/discourse/discourse/commit/e56bd3ec58ae387946220821d1ce214eed02d1b9
• https://github.com/discourse/discourse/pull/41527
• https://github.com/discourse/discourse/security/advisories/GHSA-wmc6-pmxp-xw5w

Published

Aug 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59822LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…8.2
• CVE-2026-59823LiteLLM is a proxy server (AI Gateway) to call LLM APIs in O…5.3
• CVE-2026-59825Mastodon is a free, open-source social network server based …7.4
• CVE-2026-59826Metabase is an open-source business intelligence and embedde…9.1
• CVE-2026-59827Metabase is an open-source business intelligence and embedde…8.8
• CVE-2026-59828Discourse is an open-source discussion platform. Prior to 20…5.3
• CVE-2026-5983A vulnerability was determined in D-Link DIR-605L 2.13B01. T…8.8
• CVE-2026-59830Discourse is an open-source discussion platform. Prior to 20…5.4
• CVE-2026-59831GitHub CLI (gh) is GitHub’s official command line tool. From…4.4
• CVE-2026-59832SiYuan is an open-source personal knowledge management syste…7.7
• CVE-2026-59833SiYuan is an open-source personal knowledge management syste…8.6
• CVE-2026-59834SiYuan is an open-source personal knowledge management syste…7.5