Discourse Improper Authorization Vulnerability in Post Edits Report for Moderators

A vulnerability in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, allowed moderators to access the first 40 characters of post edits from private messages and secure categories. This information was inadvertently leaked through the Post Edits admin report, creating an improper authorization issue by giving moderators access to content they should not see.

Impact

The vulnerability could lead to unauthorized disclosure of private message content, specifically post edits, to moderators who do not have the appropriate access rights.

Reproduction

To reproduce this vulnerability, a moderator can access the Post Edits admin report. Edits made to posts in private messages or secure categories will be visible, despite the moderator not having permission to view that content.

Remediation

Users can update to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2, where this vulnerability has been patched.