Discourse Whisper Post Visibility Vulnerability in Private Messages

A vulnerability in Discourse's private messaging system allowed regular participants to access whisper posts in topics they were part of. This issue was present in versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The vulnerability arose because the '/private-posts' endpoint failed to implement proper post-type visibility filters, enabling unauthorized access to sensitive content.

Impact

Exploitation of this vulnerability allowed unauthorized users to view confidential whisper posts in private message topics, breaching privacy and confidentiality.

Reproduction

To reproduce this vulnerability, log in as a regular participant in a private message topic. Send a whisper post in that topic, then access the '/private-posts.json' endpoint. The response will include the whisper post, demonstrating the lack of proper visibility filtering.

Remediation

Users can upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2, all of which include the necessary patch to address this vulnerability.