CVE-2026-59828: Discourse Post Revision Information Disclosure

Technical summary

The vulnerability stems from improper handling of post revisions in the PostRevisionSerializer component. Specifically, when generating visible diffs for adjacent post revisions, the serializer does not properly filter out revisions that should remain hidden from non-administrative users. An unauthenticated network client can view post history and retrieve diffs that inadvertently include content from restricted revisions. The issue affects multiple Discourse version branches, indicating a systemic serialization logic flaw rather than an isolated edge case. The fix ensures that hidden revision content is excluded from diff calculations and serialization output.

Business impact

Organizations running Discourse-based communities face potential information disclosure that undermines moderation controls. Deleted moderator notes, retracted sensitive information, or hidden administrative comments could become visible to regular community members through post diff inspection. This is particularly concerning for internal Discourse deployments where revision history control is part of compliance or operational governance. The exposure is passive—users viewing posts can inadvertently discover information—rather than a direct system compromise, but it erodes the integrity of community content governance.

Affected systems

Discourse instances running versions before 2026.6.0 (current release), 2026.5.1 (LTS branch), 2026.4.2 (maintenance branch), or 2026.1.5 (extended support branch) are vulnerable. The issue affects all Discourse deployments regardless of hosting model—self-hosted and managed instances are equally at risk. Specific version status should be verified against the official Discourse advisory, as patch availability varies by release channel.

Exploitability

Exploitation requires no authentication, no special privileges, and no user interaction. An attacker simply needs network access to a vulnerable Discourse instance and can view post revisions through normal browsing to inspect diffs. The attack surface is the public-facing post revision endpoint. However, the attacker must already know which posts have multiple revisions to target them, and the leaked content depends on what was previously edited and hidden—random scanning is inefficient. The barrier to exploitation is low once an instance is identified as vulnerable.

Remediation

Update Discourse to one of the patched versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, depending on your current release track. Verify the patch version against the official Discourse release notes before deploying. After patching, review access logs to determine whether post revisions were accessed during the vulnerability window; this may not detect exploitation definitively but can inform incident response scope.

Patch guidance

Discourse provides patched versions across multiple release branches to accommodate different update cadences. Identify your current version (visible in the admin console) and select the corresponding patched version: upgrade to 2026.6.0 if running current releases, 2026.5.1 if on the long-term support branch, 2026.4.2 if on an earlier maintenance branch, or 2026.1.5 for extended support. Test the patch in a staging environment before production deployment to ensure compatibility with customizations or plugins. Schedule downtime minimally; Discourse typically supports zero-downtime or brief-downtime updates depending on deployment configuration.

Detection guidance

Look for patterns of repeated access to post revision endpoints (typically /posts/{id}/revisions or similar REST paths) from the same user agent or IP, especially if the user account is not an administrator. Anomalous diff requests or requests that retrieve multiple revisions in sequence may indicate reconnaissance. Review admin audit logs for when hidden revisions were marked as such and cross-reference with web access logs for the same posts during subsequent viewing sessions. Exact detection depends on your Discourse logging configuration and access log retention.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), prioritization should account for your use of Discourse and the sensitivity of content within your community. If Discourse stores internal communications, sensitive discussions, or moderated content, the risk is heightened despite the moderate score. The lack of CISA KEV listing suggests this is not currently exploited at scale in the wild, providing a window for patching before active weaponization. Patch within 2-4 weeks if Discourse is critical; within 4-8 weeks if it is ancillary.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the low barrier to exploitation (network-based, no authentication, no user interaction) balanced against the limited scope of impact (information disclosure only, no system compromise, no integrity change). Confidentiality impact is rated low because the leaked content is limited to revision diffs that an attacker must already suspect exist. Availability and integrity are unaffected. The score does not escalate to high despite the ease of exploitation because the information disclosed is contextual and reactive, not broadly exploitable across instances or for privilege escalation.

Frequently asked questions