bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts… (CVE-2026-110762)
Description
bbPress versions before 2.6.19 have an information disclosure vulnerability that allows unauthenticated visitors to view posts in restricted subforums. This occurs because the hide_sitewide function does not properly consider ancestor forum visibility, exposing content in public subforums nested under private or hidden parents via the BuddyPress activity stream and REST endpoint. The vulnerability has a medium severity rating with a CVSS score of 3.7.
CVSS v3.1
Score 3.7low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in bbPress prior to version 2.6.19 is an information disclosure flaw where unauthenticated users can access titles, permalinks, and bodies of topics and replies in restricted subforums. This happens because the hide_sitewide function fails to respect the visibility settings of ancestor forums, leading to exposure of content in public subforums nested under private or hidden parent forums. The exposure occurs through the BuddyPress activity stream and REST API endpoints.
Potential Impact
Unauthenticated visitors can view restricted subforum posts that should be hidden, potentially leaking sensitive or private information. The impact is limited to confidentiality (information disclosure) without affecting integrity or availability.
Mitigation Recommendations
Upgrade bbPress to version 2.6.19 or later where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is not explicitly confirmed in the input data, but the version 2.6.19 indicates a fix. Verify with vendor advisory for confirmation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-45mm-3gj8-2wg3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-110762"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ad008962cdf04f656b90d09
Added to database: 10/14/2026, 22:56:22 UTC
Last enriched: 10/14/2026, 23:00:04 UTC
Last updated: 10/15/2026, 00:08:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.