Medium severity5.3NVD Advisory· Published Apr 3, 2026· Updated Apr 22, 2026
CVE-2026-34947
CVE-2026-34947
Description
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, staged user custom fields and username are exposed on public invite pages without email verification. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
2cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*+ 1 more
- cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*
- cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*range: >=2026.1.0,<=2026.1.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/discourse/discourse/security/advisories/GHSA-4rcw-wq9x-54qwnvdVendor Advisory
News mentions
2- Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays downThe Register Security · May 1, 2026
- Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays downThe Register Security · May 1, 2026