Volerion logoVolerion
Volerion logoVolerion

Discourse Insufficient Authorization Vulnerability Allowing Unauthorized Access to Private User Activity

Vulnerability

A vulnerability in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, allowed users to access another user's private activity due to inadequate authorization checks in the user actions endpoint. This issue has been addressed in the mentioned patched versions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to private user activities, allowing users to view actions that should remain confidential.

Remediation

Users are advised to upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.

Added: Mar 20, 2026, 3:32 AM
Updated: Mar 20, 2026, 3:32 AM

Vulnerability Rating

Custom Algorithm
spread
2.4
impact
0.6
exploitability
3.3
remediation
7.7
relevance
4.2
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.