CyberRota Analysis
AI-GeneratedThe EventSerializer in Discourse prior to specified versions is vulnerable to information disclosure, potentially exposing invited group names, sample invitees, and attendance statistics to unauthorized users who can view the topic. This could lead to privacy breaches and unauthorized insights into private events. Organizations using affected versions should prioritize upgrading to the fixed releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)