Discourse Private Group Membership Inference Vulnerability

A vulnerability in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allows unauthenticated users to infer private group membership of specific users. This is achieved by monitoring changes in directory results when the 'exclude_groups' parameter is used. The issue has been patched in the mentioned versions, and as a temporary measure, public access to the user directory can be disabled through the admin settings.

Impact

This vulnerability could lead to unauthorized users gaining knowledge about private group memberships, which could be sensitive information.

Remediation

Users can update to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2. Alternatively, public access to the user directory can be disabled via Admin → Settings → hide user profiles from public.