CVE-2026-26265

{"id": "CVE-2026-26265", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26265", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T16:16:56.830172Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "< 2025.12.2"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.0"}]}]}], "published": "2026-02-26T16:24:07.543", "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-crxf-p6jm-vpgw", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint allows any user, including anonymous users, to retrieve private user field values for all users in the directory. The `user_field_ids` parameter in `DirectoryItemsController#index` accepts arbitrary user field IDs without authorization checks, bypassing the visibility restrictions (`show_on_profile` / `show_on_user_card`) that are enforced elsewhere (e.g., `UserCardSerializer` via `Guardian#allowed_user_field_ids`). An attacker can request `GET /directory_items.json?period=all&user_field_ids=<id>` with any private field ID and receive that field's value for every user in the directory response. This enables bulk exfiltration of private user data such as phone numbers, addresses, or other sensitive custom fields that admins have explicitly configured as non-public. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by filtering `user_field_ids` against `UserField.public_fields` for non-staff users before building the custom field map. As a workaround, site administrators can remove sensitive data from private user fields, or disable the user directory via the `enable_user_directory` site setting."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de las versiones 2025.12.2, 2026.1.1 y 2026.2.0, una vulnerabilidad IDOR en el endpoint de elementos del directorio permite a cualquier usuario, incluidos los usuarios an\u00f3nimos, recuperar valores de campos de usuario privados para todos los usuarios en el directorio. El par\u00e1metro 'user_field_ids' en 'DirectoryItemsController#index' acepta IDs de campos de usuario arbitrarios sin comprobaciones de autorizaci\u00f3n, eludiendo las restricciones de visibilidad ('show_on_profile' / 'show_on_user_card') que se aplican en otros lugares (por ejemplo, 'UserCardSerializer' a trav\u00e9s de 'Guardian#allowed_user_field_ids'). Un atacante puede solicitar 'GET /directory_items.json?period=all&amp;user_field_ids=' con cualquier ID de campo privado y recibir el valor de ese campo para cada usuario en la respuesta del directorio. Esto permite la exfiltraci\u00f3n masiva de datos de usuario privados como n\u00fameros de tel\u00e9fono, direcciones u otros campos personalizados sensibles que los administradores han configurado expl\u00edcitamente como no p\u00fablicos. El problema est\u00e1 parcheado en las versiones 2025.12.2, 2026.1.1 y 2026.2.0 filtrando 'user_field_ids' contra 'UserField.public_fields' para usuarios que no son personal antes de construir el mapa de campos personalizados. Como soluci\u00f3n alternativa, los administradores del sitio pueden eliminar datos sensibles de los campos de usuario privados, o deshabilitar el directorio de usuarios a trav\u00e9s de la configuraci\u00f3n del sitio 'enable_user_directory'."}], "lastModified": "2026-06-17T10:26:00.573", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DB837D7-28C8-4E0F-B55F-AAAA36F32035", "versionEndExcluding": "2025.12.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CAFCC9D-53D7-4017-85A5-EE6CA5A6A11C", "versionEndExcluding": "2026.1.1", "versionStartIncluding": "2026.1.0"}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*", "vulnerable": true, "matchCriteriaId": "BB002FDC-BC71-4C46-8AAF-A34EC717E0E7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}