CVE-2026-84302

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

• CWE-862

• https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427
• https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5
• https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd
• https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f
• https://github.com/discourse/discourse/pull/42091
• https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8429SPIP versions prior to 4.4.14 contain a remote code executio…8.8
• CVE-2026-84292fast-uri serializes the port component of a URI without vali…7.5
• CVE-2026-84293The Repeater Fields for Gravity Forms plugin for WordPress i…7.2
• CVE-2026-84298Hatchet is a platform for orchestrating background tasks, AI…3.1
• CVE-2026-8430SPIP versions prior to 4.4.14 contain a remote code executio…9.2
• CVE-2026-84301FastGPT is an open-source LLM platform for building AI appli…6.3
• CVE-2026-84303gRPC-Go is the Go language implementation of gRPC. Prior to …6.3
• CVE-2026-84304gRPC-Go is the Go language implementation of gRPC. Prior to …8.7
• CVE-2026-84305sqlparse is a non-validating SQL parser module for Python. P…5.1
• CVE-2026-84306Filament is a collection of full-stack components for accele…6.5
• CVE-2026-84307Filament is a collection of full-stack components for accele…3.7
• CVE-2026-84308phpseclib is a PHP secure communications library. Prior to 3…6.3