CVE-2026-27153CWE-863

Discourse doesn't prevent moderators from exporting user Chat DMs

Low · published February 26, 2026

CVSS v4.0
1.3
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, moderators could export user Chat DMs via the CSV export endpoint by exploiting an overly permissive allowlist in `can_export_entity?`. The method allowed moderators to export any entity not explicitly blocked instead of restricting to an explicit allowlist. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

The record
Technical detail
CVSS v4.0
1.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-02-26T21:16Z
EPSS history
Timeline
  • 26 FEB 21:16Z
    Discourse doesn't prevent moderators from exporting user Chat DMs
    cvelistv5