Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.
Problem types
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-285: Improper Authorization
CWE-639: Authorization Bypass Through User-Controlled Key
Product status
>= 2026.2.0-latest, < 2026.2.1
= 2026.3.0-latest
References
github.com/...course/security/advisories/GHSA-5f9h-vp7v-7vq5