Discourse User Archive Access Vulnerability for Moderators
Vulnerability
A vulnerability in Discourse allows users with moderation privileges to access private user archives, which should be restricted. This issue is present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. The unauthorized access leads to a breach of confidentiality, as private topics and posts are leaked through the archives.
Impact
The vulnerability results in unauthorized access to private user content, including topics and posts, by moderators, causing a breach of confidentiality.
Remediation
To address this vulnerability, site administrators can temporarily revoke the moderation role from all moderators until the Discourse instance is upgraded to a patched version. The updated versions are 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.