CVE-2026-34947CWE-200

Discourse: Staged user custom fields are exposed on public invite pages

Low · published April 3, 2026

CVSS v4.0
2.7
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

The record
Technical detail
CVSS v4.0
2.7 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00353 · 27.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-04-03T21:27Z
EPSS history
Timeline
  • 03 APR 21:27Z
    Discourse: Staged user custom fields are exposed on public invite pages
    cvelistv5