Discourse Access Control Bypass Vulnerability in AI Discover Persona Feature Allowing Unauthorized Data Disclosure and Impersonation

A vulnerability exists in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. An endpoint allows any authenticated user to bypass access controls related to the AI Discover persona feature. This bypass grants ongoing direct message access to personas linked with staff-only categories, RAG document sets, or automated tools, leading to unauthorized data disclosure. Additionally, the affected controller accepts arbitrary user IDs, enabling attackers to impersonate other accounts and initiate unwanted AI conversations on their behalf, creating confusing or abusive private message traffic.

Impact

Exploitation of this vulnerability could result in unauthorized access to sensitive data through improper disclosure via direct messages. It also allows for impersonation of other users, potentially leading to misuse of the AI conversation feature and disruption of private message communications.

Remediation

Users are advised to upgrade to Discourse versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0.