CVE-2026-31869
Discourse: Composer mentions endpoint leaks hidden group membership through PM `allowed_names` check
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By supplying allowed_names referencing a hidden-membership group and probing arbitrary usernames, an attacker can infer membership based on whether user_reasons returns "private" for a given user. This bypasses group member-visibility controls. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, restrict the messageable policy of any hidden-membership group to staff or group members only, so untrusted users cannot reach the vulnerable code path.
| CWE | CWE-200 CWE-285 CWE-639 |
| Vendor | discourse |
| Product | discourse |
| Published | Mar 20, 2026 |
| Last Updated | Mar 20, 2026 |
Get instant alerts for discourse discourse
Be the first to know when new unknown vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.