Discourse CSV Export Vulnerability for Admin-Only Reports

A vulnerability in Discourse allows moderators to export CSV data from reports restricted to admins. This issue affects Discourse versions 2026.1.0-latest prior to 2026.1.3, 2026.2.0-latest prior to 2026.2.2, and 2026.3.0-latest prior to 2026.3.0. The vulnerability arises because moderators can bypass report visibility restrictions, potentially exposing sensitive operational data meant solely for admin eyes.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive operational data by allowing moderators to export admin-only reports, such as 'top_uploads', which could be misused or disclosed inappropriately.

Reproduction

To reproduce this vulnerability, a moderator can use the CSV export endpoint to request admin-only reports. The export will be processed without the necessary visibility permissions, bypassing the restrictions in place for such reports.

Remediation

Users are advised to upgrade to Discourse versions 2026.1.3, 2026.2.2, or 2026.3.0.