LiveActive security incident?Get immediate response
CVE Record

CVE-2026-26265: Discourse has IDOR vulnerability in the directory items endpoint

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (`show_on_profile` / `show_on_user_card`) that are enforced elsewhere (e.g., `UserCardSerializer` via `Guardian#allowed_user_field_ids`). An attacker can request `GET /directory_items.json?period=all&user_field_ids=<id>` with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering `user_field_ids` against `UserField.public_fields` for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user fields, or disable the user directory via the `enable_user_directory` site setting.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Discourse sites before the fixed releases may expose private custom user profile fields through the user directory. The issue can affect anonymous visitors if the directory is enabled. Sensitive data such as phone numbers or addresses stored in private fields could be collected in bulk.

Executive priority

Treat as high priority for communities storing sensitive member data. Prioritize patching public Discourse sites because unauthenticated access may enable bulk privacy exposure. Business impact is data confidentiality and user trust, not service outage.

Technical view

CVE-2026-26265 is an IDOR in Discourse’s directory items endpoint. The user_field_ids parameter accepted arbitrary field IDs without applying the visibility checks used elsewhere. Non-staff users, including anonymous users, could retrieve private user field values for directory users. Fixes filter requested fields to public fields for non-staff users.

Likely exposure

Internet-facing Discourse instances are exposed if they run affected versions, have the user directory enabled, and store sensitive data in private custom user fields. Exposure is primarily confidentiality loss, not system takeover.

Exploitation context

The advisory does not report active exploitation, and the CVE is not marked KEV. Exploitation is low complexity, network-accessible, requires no authentication, and needs no user interaction, according to the CVSS vector.

Researcher notes

The weakness is CWE-863 authorization failure. The vulnerable path is the directory items controller’s handling of requested user field IDs. The patch behavior described is authorization filtering against public fields for non-staff users. No public exploit or active exploitation evidence is provided in the sources.

Mitigation direction

  • Upgrade Discourse to 2025.12.2, 2026.1.1, 2026.2.0, or later fixed releases.
  • If immediate upgrade is not possible, disable the user directory setting.
  • Remove sensitive data from private custom user fields until patched.
  • Review vendor advisory for deployment-specific guidance.

Validation and detection

  • Inventory Discourse versions and compare against fixed release numbers.
  • Confirm whether the user directory is enabled.
  • Identify private custom user fields containing sensitive data.
  • After upgrading, verify non-staff users cannot retrieve non-public user fields through directory responses.
  • Review access logs for unusual directory queries involving custom user fields.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-863: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-26265 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-26265Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
discoursediscourse< 2025.12.2, >= 2026.1.0-latest, < 2026.1.1, >= 2026.2.0-latest, < 2026.2.0Listed
Weakness

CWE details

CWE-863

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-863 · source CWE mapping

Incorrect Authorization

Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs