CVE-2026-27162 MEDIUM

CVE-2026-27162: DIscourse doesn't prevent whispers to leak in excerpts

Vendor Discourse
Product discourse
Weakness CWE-200 · Info exposure
Published February 26, 2026
Last update March 3, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian)` to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
March 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-42490 EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2022-29241 Known or guessable hidden files may be accessed in Jupyter Server CVE-2021-32716 Internal hidden fields are visible on to many associations in admin api CVE-2025-48064 GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure CVE-2024-9538 ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template