Discourse Staged User Custom Fields Exposure Vulnerability on Public Invite Pages
Vulnerability
A vulnerability exists in Discourse versions 2026.1.0-latest prior to 2026.1.3, 2026.2.0-latest prior to 2026.2.2, and 2026.3.0-latest prior to 2026.3.0. This issue allows staged user custom fields and usernames to be exposed on public invite pages without requiring email verification.
Impact
The vulnerability leads to unauthorized exposure of staged user custom fields and usernames on public invite pages, bypassing email verification.
Remediation
Users are advised to upgrade to Discourse versions 2026.1.3, 2026.2.2, or 2026.3.0.
Added: Apr 3, 2026, 10:25 PM
Updated: Apr 3, 2026, 10:25 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
0.6exploitability
7.4remediation
0.0relevance
5.1threat
0.0urgency
2.9incentive
4.2Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.