CVE-2026-31869

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.

How to fix CVE-2026-31869

To remediate CVE-2026-31869, upgrade the affected package to a fixed version below.

• —upgrade to 2026.1.2 or later

Is CVE-2026-31869 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 2026.1.0, < 2026.1.2, >= 2026.2.0, < 2026.2.1, >= 2026.3.0, < 2026.3.0

CVSS scores

References (2)

• WEBgithub.com/discourse/discourse/security/advisories/GHSA-5f9h-vp7v-7vq5
• WEBnvd.nist.gov/vuln/detail/CVE-2026-31869