What’s Vulnerable › Vulnerabilities

CVE-2026-59828: Discourse: Hidden post revisions leak through adjacent visible diffs

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-09 · updated 2026-07-13
• Weakness: CWE-200

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions that should be hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Affected products

• discourse: from 2026.1.0 before 2026.1.5; from 2026.4.0 before 2026.4.2; from 2026.5.0 before 2026.5.1; 2026.6.0 — fixed in 2026.1.5, 2026.4.2, 2026.5.1

How to fix

Upgrade to a fixed version: discourse 2026.1.5, 2026.4.2, 2026.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/discourse/discourse/commit/1f26c1163ce87a2abbd1d01780ab1b5fb16e75f6
• https://github.com/discourse/discourse/commit/8b773332b0f937dfcd894ed56d56fc5a81578d9d
• https://github.com/discourse/discourse/commit/8d36da1b68c906592abde3f2e94d505cdf097435
• https://github.com/discourse/discourse/commit/d58988d46bb1019bfa8b8330ae81a1a134e08511
• https://github.com/discourse/discourse/releases/tag/v2026.1.5
• https://github.com/discourse/discourse/releases/tag/v2026.4.2
• https://github.com/discourse/discourse/releases/tag/v2026.5.1
• https://github.com/discourse/discourse/releases/tag/v2026.6.0
• https://github.com/discourse/discourse/security/advisories/GHSA-q456-4f8q-42vx

Get alerted when CVE-2026-59828 or the next vulnerability affects your stack