DiscourseApplication

CVE-2026-24742

MEDIUM · 6.5 CVSS v3.1 Published 2026-01-28

Fix available

A fix is available. Upgrade to 3.5.4 / 2025.11.2 or later.

See remediation →

71/100

Remediation priority · Elevated

Remotely reachable Zero-click

Official description

NVD · unedited

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and secrets, API key details, site setting changes, private message content, restricted category names and structures, and private chat channel titles. This allows moderators to bypass intended access controls and extract confidential data by monitoring the staff action logs. With leaked webhook secrets, an attacker could potentially spoof webhook events to integrated services. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. As a workaround, site administrators should review and limit moderator appointments to fully trusted users. There is no configuration-based workaround to prevent this access.

Technical summary

dbcve analysis · high confidence

Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 contain an insecure direct object reference in the staff action logs where non-admin moderators can access sensitive data (webhook URLs/secrets, API keys, PMs, private category info, chat titles) that should be admin-only.

MitigationUpdate Discourse to patched version (3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0). As a compensating control, audit moderator appointments and ensure only fully trusted users hold moderator privileges.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions

NVD · CPE data

DiscourseApplication

Affected:< 3.5.4>= 2025.11.0, < 2025.11.2= 2025.12.0= 2026.1.0

CVSS breakdown

From the vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Am I affected?

dbcve checks

Work through these to decide whether this CVE applies to you.

Identify installed Discourse version

Access the Discourse admin panel at /admin/dashboard or run `cd /var/www/discourse && ./launcher enter app rails r 'puts Discourse::VERSION::STRING'` from the server command line

Affected if The version is below 3.5.4, or is 2025.11.0/2025.11.1, 2025.12.0, or 2026.1.0
Confirm staff action logs feature exists

Log in as an admin and navigate to /admin/logs/staff_action_logs to confirm the staff action logs interface is available in this installation

Affected if The staff action logs interface is accessible
Verify moderator role configuration

Navigate to /admin/users/list/moderators to identify any users with moderator (not admin) privileges

Affected if There are users assigned the moderator role who are not administrators
Test IDOR access as non-admin moderator

Log in as a non-admin moderator account and attempt to access /admin/logs/staff_action_logs - observe whether entries containing webhook URLs, API keys, private messages, or private category names are visible in the logs

Affected if A non-admin moderator can view staff action log entries containing sensitive data (webhook URLs, API keys, PM content, private category details) that should only be visible to admins

Your environment is affected if you run an affected Discourse version (below 3.5.4, or 2025.11.0-2025.11.1, 2025.12.0, or 2026.1.0) AND have non-admin moderators who can access staff action logs containing sensitive administrative data.

Generated from the published advisory. Verify against your own configuration.

Remediation

dbcve · scoped

Upgrade available Upgrade to 3.5.4 / 2025.11.2 or later

Fixed in 3.5.42025.11.2

Interim mitigation

Update Discourse to patched version (3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0). As a compensating control, audit moderator appointments and ensure only fully trusted users hold moderator privileges.

Recommended fix High confidence

2026.1.1 (latest stable) or at minimum 3.5.4 / 2025.11.2 / 2025.12.1 / 2026.1.0 depending on current branch

Identify the current Discourse version by navigating to /admin/dashboard on the Discourse instance
Determine the appropriate target version based on the current branch: for 3.5.x line upgrade to 3.5.4, for 2025.11.x upgrade to 2025.11.2, for 2025.12.x upgrade to 2025.12.1, or for 2026.1.x upgrade to 2026.1.1 or later
Back up the Discourse database and all site data before proceeding
If using Docker: run 'cd /var/discourse && git pull' followed by './launcher rebuild app'
If using non-Docker install: follow standard upgrade procedure for the specific OS (e.g., apt-get update && apt-get upgrade for Ubuntu/Debian)
After upgrade completes, verify the version by checking /admin/dashboard
Log in as an administrator and review staff action logs to confirm the fix is applied by ensuring moderators no longer see sensitive fields like webhook secrets and API keys

Caveat Security-only patch; no expected breaking changes but test in staging first as with any upgrade

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Discourse Scoped from the published advisory

Consultation2.0 h
Implementation4.0 h
Testing3.0 h
Review / QA2.0 h

11.0 hours of engineering $1,930

Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,088.

Scan for this in your stack

Free · runs locally

dbcve dependency scanner

Check whether your project pulls in CVE-2026-24742 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References

Primary sources

github.comThird Party Advisory
nvd.nist.govNVD record

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-24742 in production — separate from our analysis above.

Notes0 Guidelines

Know something about CVE-2026-24742?

The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.

The version that genuinely resolved it — not the one the vendor claimed
A config change or rule that shut the vector down
A gotcha in the upgrade path that cost you an afternoon

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here

Verified mitigations, workarounds, and config changes
Version or environment caveats, and links to real fixes
No weaponised exploit code, or anything meant to cause harm
No spam, self-promotion, credentials, or personal data

At a glance

A fix existsUpgrade to 3.5.4 / 2025.11.2 or later

Severity 6.5 Medium

Exploit likelihood EPSS, next 30 days 0.3%

Affects: Discourse

Remediation

Need this fixed?

Fix this in Discourse 11 hrs · Moderate

Typical engagement from $1,930

Get a fix See the full breakdown ↓

We specialise in CVE remediation. Send your environment and we’ll scope CVE-2026-24742 and return a fixed quote.

You’ll deal with our team directly and deploy the reviewed fix to staging first — never straight to production.

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

Check your environment

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

Scan for this in your stack

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Practitioner notes

No notes yet

Official description

Technical summary

Affected products & versions

CVSS breakdown

Am I affected?

Remediation

References