Discourse Whispers Access Control Vulnerability in `posts_nearby` Function

A vulnerability exists in Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0, where the `posts_nearby` function improperly handles topic access. It returns all posts regardless of type, including whispers that should only be visible to specific users. This issue can lead to unauthorized visibility of private messages. The vulnerability arises because the function does not correctly filter post types based on user permissions. Instead of using the appropriate access control method, it exposes sensitive information by including whispers in the response.

Impact

This vulnerability can cause unauthorized exposure of whispers, allowing users to see private messages that should be restricted to certain individuals.

Remediation

Users can upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0 to address this vulnerability.