CVE-2026-34947
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Discourse, an open-source discussion platform, has a vulnerability that exposes staged user custom fields and usernames on public invite pages without email verification. This affects versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0.
Risk Assessment
An attacker can obtain sensitive user information (custom fields and usernames) without authentication, which could be used for further attacks or privacy violations.
Recommendation
It is recommended to update Discourse to versions 2026.1.3, 2026.2.2, or 2026.3.0 (or later), which include the fix.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.