Discourse: Review queue exposes flag-related private message excerpts to category group moderators (CVE-2026-59829)
A vulnerability in Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1 allows category group moderators to see excerpts of private messages attached to flags in the review queue, even if they are not participants in those messages. This exposure is limited to a small excerpt and does not allow modification or deletion of content. The issue affects sites with category group moderation enabled and involves flag messages intended only for moderators. The vulnerability has been fixed in the specified versions.
AI Analysis
Technical Summary
Discourse, an open-source discussion platform, had a vulnerability (CVE-2026-59829) where category group moderators could view excerpts and permalinks of private messages attached to flags in the review queue without being authorized participants. This occurred on sites with category group moderation enabled and affected official plugins creating such messages and core flags raised before a moderator's group was granted moderation of the category. The confidentiality of limited excerpts of flag-related private messages was compromised, but no content integrity or availability was affected. The issue is resolved in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
Potential Impact
Confidentiality of limited excerpts of private messages attached to flags is compromised for category group moderators who are not authorized participants. There is no impact on content modification or deletion. The exposure is limited to a small portion of private flag-related messages.
Mitigation Recommendations
Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1 or later, where this vulnerability is fixed. No other mitigation is necessary as the issue is resolved in these official releases.
Discourse: Review queue exposes flag-related private message excerpts to category group moderators (CVE-2026-59829)
Description
A vulnerability in Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1 allows category group moderators to see excerpts of private messages attached to flags in the review queue, even if they are not participants in those messages. This exposure is limited to a small excerpt and does not allow modification or deletion of content. The issue affects sites with category group moderation enabled and involves flag messages intended only for moderators. The vulnerability has been fixed in the specified versions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Discourse, an open-source discussion platform, had a vulnerability (CVE-2026-59829) where category group moderators could view excerpts and permalinks of private messages attached to flags in the review queue without being authorized participants. This occurred on sites with category group moderation enabled and affected official plugins creating such messages and core flags raised before a moderator's group was granted moderation of the category. The confidentiality of limited excerpts of flag-related private messages was compromised, but no content integrity or availability was affected. The issue is resolved in Discourse versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1.
Potential Impact
Confidentiality of limited excerpts of private messages attached to flags is compromised for category group moderators who are not authorized participants. There is no impact on content modification or deletion. The exposure is limited to a small portion of private flag-related messages.
Mitigation Recommendations
Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1 or later, where this vulnerability is fixed. No other mitigation is necessary as the issue is resolved in these official releases.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-discourse-2026-59829
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-59829"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a885f28acd9273b493f81a3
Added to database: 08/21/2026, 14:22:32 UTC
Last enriched: 08/21/2026, 14:37:36 UTC
Last updated: 08/21/2026, 22:52:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.