{"apiVersion":"1.0","identifier":"CVE-2026-55704","description":"Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group-s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","publishedAt":"2026-08-17T16:16:59","lastModifiedAt":"2026-08-17T22:17:14","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55704","cvssScore":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","epssProbability":0.00169,"riskScore":0.44,"affectedProduct":"Discourse","affectedVersions":"<2026.1.6, <2026.5.2, <2026.6.1, <2026.7.0","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55704","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55704","en":"https://www.redsauce.net/en/cves/CVE-2026-55704","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55704","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55704","de":"https://www.redsauce.net/de/cves/CVE-2026-55704","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55704","el":"https://www.redsauce.net/el/cves/CVE-2026-55704"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55704"}}