CVE-2026-59829

Executive Summary

CVE-2026-59829 is a missing authorization vulnerability (CWE-862) in Discourse, an open-source discussion platform. On Discourse instances with category group moderation enabled, a category group moderator could view a limited excerpt and permalink of flag-related private messages they were not authorized to access. The issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1. No public exploit is known, and the CVE is not listed in CISA KEV.

Technical Analysis

The vulnerability is an authorization logic flaw that affects the review queue in Discourse deployments that enable category group moderation. The NVD description explains that the review queue could include an excerpt, and a permalink, of the private message attached to a flag, even when the reviewing category moderator was not a participant in that private message.

The root cause is that notify_moderators flag messages are addressed to the category's moderation groups as they existed when the flag was raised, rather than being re-checked against the reviewer's current membership and participation status at the time of display. When a moderator is granted moderation rights for a category after a flag has already been raised, that individual can later see flag-discussion content from before their authorization was added. The same issue applies to official plugins that create such flag-related private messages.

No specific function names or code paths are provided in the NVD description, so implementation-level detail is not available. The vulnerable class is clear: an authorization check is performed at flag creation time for message delivery, but the review queue rendering path does not appear to enforce the same participation requirement when the message excerpt or permalink is displayed to a reviewer.

The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a network-exploitable issue requiring low-level privileges, with low confidentiality impact and no integrity or availability impact. The attack surface is the web-based review queue. An attacker must already be an authenticated user with category moderator privileges, and the site must have category group moderation enabled. The vulnerability is not remotely exploitable by unauthenticated users.

The impact is limited to disclosure of a short excerpt of a private message and a permalink that may reveal the existence or topic of the underlying discussion. The NVD description explicitly states that no content can be modified or deleted. Official plugins that create such flag messages expand the exposure surface, because the same flawed authorization path is used.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template has been identified. The attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification
   An attacker who already holds a category moderator role on a Discourse site identifies that category group moderation is enabled. The attacker can likely review the groups they belong to and identify categories where their moderation permission was granted recently.

2. Triggering the flaw
   The attacker accesses the Discourse review queue for a category in which their moderation group was granted access after certain flags were raised. Because the flag's notify_moderators private message was addressed to the moderation group at the time the flag was created, the review queue renders the excerpt and permalink of that private message even though the attacker was not a participant.

3. Payload / execution method
   There is no direct payload, injection, or code execution. The exploit is an access-control bypass performed through normal review queue interaction. The attacker simply opens the review queue or the relevant flag entry and reads the displayed excerpt.

4. Post-exploitation impact
   The attacker gains access to a limited portion of a private message, which may contain details about user reports, moderator discussions, or content moderation decisions. The permalink could reveal the private message thread location, potentially enabling further reconnaissance. The attacker cannot modify or delete the disclosed content.

This attack chain should be treated as an inferred model. Actual exploitation may vary depending on the Discourse version, the plugin in use, and the site's group configuration.

Impact Assessment

The business impact of CVE-2026-59829 is unauthorized disclosure of internal moderation communication. On affected Discourse sites, the confidentiality of flag-related private messages is weakened when moderation group membership changes over time. Category moderators may become exposed to private message excerpts that contain sensitive user-reported information, moderator deliberations, or references to other private content.

The CVSS score of 4.3 places this in the medium severity range. The confidentiality subscore is low because only a limited excerpt and permalink are exposed; no modification or deletion of content is possible. The attack requires low privileges, but no user interaction from the victim is needed. The network vector indicates that the review queue is reachable via the web application.

The blast radius is limited to Discourse sites that meet all of the following conditions:

• The site runs a vulnerable version prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1.
• Category group moderation is enabled.
• A category moderator's access to a moderation group began after flags covered by the flawed access control logic were raised.
• Official plugins that create flag-related private messages are used, or core flags were raised before the moderator's group gained moderation of the category.

There is no evidence of active exploitation, no CISA KEV listing, and no known threat actor campaigns at the time of this report.

Detection Guidance

Because this is an application-layer authorization flaw, detection is best performed on application and audit logs. Network signatures can only provide coarse indicators and may not differentiate between legitimate and malicious review queue use. All rules below should be tuned to site-specific logging and role naming conventions.

Sigma Rule

title: Potential Discourse Review Queue Private Message Access - CVE-2026-59829
status: experimental
description: Detects application log entries in which a category moderator accesses review queue content associated with notify_moderators private messages in Discourse.
logsource:
  category: application
  product: discourse
detection:
  selection:
    event.action:
      - review_queue_view
      - review_queue_show
    event.message|contains:
      - "notify_moderators"
      - "private_message_excerpt"
  filter:
    user.roles|contains: "system_admin"
  condition: selection and not filter
falsepositives:
  - Legitimate access by a user who is both a category moderator and a participant in the private message.
level: medium

YARA Rule

rule CVE_2026_59829_Discourse_ReviewQueue_PrivateMessage_Leak
{
    meta:
        author = "Valters IT"
        description = "Detects log or configuration artifacts referencing notify_moderators and review queue behavior in Discourse."
        cve = "CVE-2026-59829"
        date = "2026-06-01"
    strings:
        $s1 = "notify_moderators" ascii wide nocase
        $s2 = "review_queue" ascii wide nocase
        $s3 = "category_group_moderation" ascii wide nocase
        $s4 = "flag_message" ascii wide nocase
    condition:
        $s1 and $s2 and ($s3 or $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-59829 Discourse Review Queue Access Attempt"; flow:established,to_server; http.server; content:"Discourse"; http.uri; content:"review"; http.method; content:"GET"; pcre:"/review[\/?]/Ui"; sid:202659829; rev:1; metadata:created_at 2026-06-01, updated_at 2026-06-01, cve CVE-2026-59829, severity medium;)

This rule detects HTTP requests to the review queue feature on Discourse servers. It is not a deterministic exploit signature; it is intended to trigger further investigation of review queue activity.

Elastic Detection

any where event.dataset == "discourse.audit" and
  message like "*review_queue*" and
  message like "*notify_moderators*" and
  user.roles like "*category_moderator*"

The query can be extended with a join against the list of private message participants when such data is available in the audit index.

Splunk SPL Query

index=discourse sourcetype=discourse:audit
  ("review_queue" OR "review queue") "notify_moderators" "category_moderator"
| stats earliest(_time) as first_seen latest(_time) as last_seen count by user.name src_ip
| where count > 5

SOC analysts should review users who repeatedly access review queue content containing notify_moderators private message references, especially if their roles do not include system administration.

Wazuh OSSEC Rule

<group name="discourse,">
  <rule id="100598" level="6">
    <decoded_as>json</decoded_as>
    <field name="message">review_queue</field>
    <field name="message">notify_moderators</field>
    <description>Discourse CVE-2026-59829: review queue private message excerpt accessed by category moderator</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

This rule generates an alert when log entries mention both the review queue and notify_moderators, indicating a potential exposure of flag-related private messages.

Mitigation & Patch Guidance

Patch confidence is currently 0/4 according to the tracked patch intelligence source. The NVD description states that fixed versions exist, but no concrete patch evidence is available in the tracked sources. Organizations should treat the vendor-provided fixed versions as the intended upgrade target while verifying that official patches and release notes are actually published before deployment.

Immediate mitigations:

• If category group moderation is not essential, disable it temporarily.
• Restrict review queue access to system administrators where possible.
• Avoid granting category moderation rights to new groups after flags have already been raised, unless the review queue content is known to be safe for the new moderators.
• Audit existing moderation group membership changes to identify users who may have been exposed to this flaw.
• Review any official plugins that create flag-related private messages and consider disabling them until patched.

Patch / upgrade steps:

• Upgrade Discourse to one of the fixed release trains: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.1, depending on the installed release branch.
• Test the upgrade in a staging environment before production deployment.
• Verify the release notes from the official Discourse channel to confirm the patch addresses CVE-2026-59829.

Long-term hardening:

• Enforce least privilege for all moderation roles.
• Implement recurring audits of category group moderation membership.
• Enable detailed application and review queue audit logging.
• Integrate Discourse logs with SIEM or EDR pipelines to support the detection rules above.
• Subscribe to official Discourse security announcements to receive timely patch information.

References

• NVD Entry for CVE-2026-59829: https://nvd.nist.gov/vuln/detail/CVE-2026-59829
• Discourse Official Site: https://www.discourse.org/
• Discourse GitHub Repository: https://github.com/discourse/discourse
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-59829 is not listed)

No known threat actor campaigns, exploit-in-the-wild evidence, or public exploit code has been identified at the time of this report.