CVE-2026-45780: Discourse Event Metadata Information Disclosure

Technical summary

EventSerializer in Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 fails to enforce proper access controls when serializing event objects for API responses or topic views. The vulnerability allows unauthenticated or low-privilege users to enumerate invited group names, retrieve sample invitee information, and observe attendance statistics for private events by leveraging their ability to view the containing topic. This is classified as an information disclosure vulnerability (CWE-200) with a network-accessible attack vector and no special privileges or user interaction required.

Business impact

For Discourse operators hosting community or internal discussion forums, this vulnerability could expose organizational structure or sensitive group memberships to unauthorized observers. If events are used for employee onboarding, executive meetings, or restricted customer groups, the disclosure of group names and attendee samples may reveal business relationships, team hierarchies, or strategic initiatives. The impact depends on what sensitive information is embedded in group names and attendance lists. Reputational harm and compliance violations (e.g., GDPR data leakage) are possible if the exposed data involves personal information.

Affected systems

All Discourse instances running versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 are affected. The vulnerability affects the core Discourse platform across all deployment models (self-hosted, cloud-hosted). Organizations using older release channels should verify their current version against the fixed versions listed and prioritize patching if still on unsupported branches.

Exploitability

The attack requires only network access and the ability to view a topic containing a private event—no authentication or special privileges are necessary. An attacker could systematically crawl publicly accessible topics to harvest event metadata. The CVSS score of 5.3 (MEDIUM) reflects low attack complexity and broad accessibility, but limited confidentiality impact since only metadata is exposed, not the full invitee list or protected event content itself. There is no known public exploit code, and this vulnerability has not been added to the CISA KEV catalog.

Remediation

Upgrade affected Discourse instances to one of the patched versions: 2026.6.0 (latest stable), 2026.5.1 (LTS branch), 2026.4.2 (extended support), or 2026.1.5 (legacy support). Before upgrading, review your deployment backup and test the patch in a staging environment. After patching, validate that EventSerializer properly filters event metadata in API responses based on user permissions. No workarounds or configuration changes mitigate this vulnerability; patching is mandatory.

Patch guidance

1. Verify your current Discourse version via the admin panel (Settings > About). 2. Consult the official Discourse security advisory and release notes to confirm the correct patched version for your branch. 3. Back up your Discourse database and configuration. 4. Follow the standard upgrade procedure for your deployment method (Docker, source install, or managed hosting). 5. Test event visibility and API responses in a staging environment before rolling out to production. 6. Monitor logs for any anomalous access patterns to event endpoints immediately after patching. 7. If you cannot upgrade immediately, restrict topic visibility or disable event features at the category level.

Detection guidance

Monitor API logs for repeated requests to /t/{topic-id}.json or event-related API endpoints from anonymous or low-privilege users. Look for patterns of crawling topics known to contain events. Check Discourse logs for EventSerializer calls and compare serialized output against the expected permission boundaries. Audit which users or API tokens have accessed event metadata. If your Discourse instance exposes metrics or analytics, review for anomalous queries targeting event statistics. Post-patch, validate that event metadata is no longer present in unauthenticated API responses.

Why prioritize this

Although the CVSS score is MEDIUM, prioritize patching because the vulnerability requires no attacker skill or privileges and affects metadata that often contains organizational intelligence. If your Discourse instance hosts private teams, customer groups, or executive discussions, the reputational and compliance risks are elevated. Patching is straightforward and low-risk; there is no reason to defer.

Risk score, explained

The CVSS v3.1 score of 5.3 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and low confidentiality impact (C:L). The score does not account for business context; organizations with highly sensitive event information should treat this as HIGH priority despite the MEDIUM CVSS rating.

Frequently asked questions