« Volver al listado

CVE-2026-26265

Estado: AnalizadaAlta (7.5)—

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (`show_on_profile` / `show_on_user_card`) that are enforced elsewhere (e.g., `UserCardSerializer` via `Guardian#allowed_user_field_ids`).

Leer descripción completaMostrar menos

An attacker can request `GET /directory_items.json?period=all&user_field_ids=<id>` with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering `user_field_ids` against `UserField.public_fields` for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user fields, or disable the user directory via the `enable_user_directory` site setting.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

IDOR en endpoint sin autenticación (AV:N/PR:N/UI:N) permite exfiltración masiva de datos privados de usuarios (teléfono, dirección, campos personalizados sensibles) en directorio público. Acceso a información de credenciales/cuentas de usuario.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkVulnerability ScanningUser Account ManagementPassword Policies

Tecnologías afectadas (1)

Discourse — Discourse

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26265",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26265",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-27T16:16:56.830172Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "< 2025.12.2"
            },
            {
              "status": "affected",
              "version": ">= 2026.1.0-latest, < 2026.1.1"
            },
            {
              "status": "affected",
              "version": ">= 2026.2.0-latest, < 2026.2.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-26T16:24:07.543",
  "references": [
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (`show_on_profile` / `show_on_user_card`) that are enforced elsewhere (e.g., `UserCardSerializer` via `Guardian#allowed_user_field_ids`). An attacker can request `GET /directory_items.json?period=all&user_field_ids=<id>` with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering `user_field_ids` against `UserField.public_fields` for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user fields, or disable the user directory via the `enable_user_directory` site setting."
    },
    {
      "lang": "es",
      "value": "Discourse es una plataforma de discusión de código abierto. Antes de las versiones 2025.12.2, 2026.1.1 y 2026.2.0, una vulnerabilidad IDOR en el endpoint de elementos del directorio permite a cualquier usuario, incluidos los usuarios anónimos, recuperar valores de campos de usuario privados para todos los usuarios en el directorio. El parámetro 'user_field_ids' en 'DirectoryItemsController#index' acepta IDs de campos de usuario arbitrarios sin comprobaciones de autorización, eludiendo las restricciones de visibilidad ('show_on_profile' / 'show_on_user_card') que se aplican en otros lugares (por ejemplo, 'UserCardSerializer' a través de 'Guardian#allowed_user_field_ids'). Un atacante puede solicitar 'GET /directory_items.json?period=all&amp;user_field_ids=' con cualquier ID de campo privado y recibir el valor de ese campo para cada usuario en la respuesta del directorio. Esto permite la exfiltración masiva de datos de usuario privados como números de teléfono, direcciones u otros campos personalizados sensibles que los administradores han configurado explícitamente como no públicos. El problema está parcheado en las versiones 2025.12.2, 2026.1.1 y 2026.2.0 filtrando 'user_field_ids' contra 'UserField.public_fields' para usuarios que no son personal antes de construir el mapa de campos personalizados. Como solución alternativa, los administradores del sitio pueden eliminar datos sensibles de los campos de usuario privados, o deshabilitar el directorio de usuarios a través de la configuración del sitio 'enable_user_directory'."
    }
  ],
  "lastModified": "2026-06-17T10:26:00.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DB837D7-28C8-4E0F-B55F-AAAA36F32035",
              "versionEndExcluding": "2025.12.0"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CAFCC9D-53D7-4017-85A5-EE6CA5A6A11C",
              "versionEndExcluding": "2026.1.1",
              "versionStartIncluding": "2026.1.0"
            },
            {
              "criteria": "cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB002FDC-BC71-4C46-8AAF-A34EC717E0E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}