CVE-2026-45780CWE-200

Discourse: Private event sample invitees are serialized to non-invited event viewers

Medium · published July 9, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, EventSerializer could expose invited group names, sample invitees, and attendance statistics to users who could view the topic but were not entitled to view the private event invitee list. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00497 · 41.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-07-09T22:08Z
EPSS history
Timeline
  • 09 JUL 22:08Z
    Discourse: Private event sample invitees are serialized to non-invited event viewers
    cvelistv5