CVE-2026-55704
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group's activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material.
Risk Assessment
Users could access unpublished drafts, potentially leading to leakage of confidential information before official publication.
Recommendation
Update Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 to fix the vulnerability.
Original NVD description (English source)
Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.