--- cve: "CVE-2026-84302" severity: "MEDIUM" cvss: 4.2 epss: "2.1%" vendor: "discourse" kev: false exploited: false published: "2026-09-24 17:17:06" tags: [cve, security, medium] source: tsecurity.de CVE-Dossier exported: "2026-09-26T08:08:27+02:00" --- # CVE-2026-84302 > 4.2 MEDIUM · 🧪 PoC ## Beschreibung Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Hoch | good | | PR Privilegien | Hoch | good | | UI Interaktion | Erforderlich | good | | S Scope | Unverändert | good | | C Vertraulichkeit | Hoch | bad | | I Integrität | Keine | good | | A Verfügbarkeit | Keine | good | ## Patch verfügbar (OSV) - ded677e00beb0e9bae6e70b69582aecfb72b5477 (Commit) - b6419ddb26f109092cdc5fdc4b2624fe95a5e8d4 (Commit) ## Referenzen - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-84302) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_