Auth bypass in Discourse

CVE-2026-31869

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals hidden group membership to any authenticated user who can message the group. By…

Vulnerability class: Information Disclosure

EPSS: 0.001 (17.1th percentile) — read the EPSS interpretation.