A critical authorization bypass in the Discourse directory items endpoint allows unauthenticated attackers to perform bulk exfiltration of private user data.

This is an Insecure Direct Object Reference (IDOR) vulnerability (CWE-863) within the DirectoryItemsController#index function. An unauthenticated attacker can supply arbitrary user field IDs via the user_field_ids parameter to bypass visibility checks and access sensitive, non-public user information.

The vulnerability poses a severe risk to user privacy and regulatory compliance. Because the exploit is unauthenticated and automatable, attackers can perform bulk exfiltration of sensitive custom user fields, such as phone numbers or addresses, which could lead to significant reputational damage and legal liability. The CVSS score of 7.5 reflects the high impact on confidentiality for a platform that stores personal data.

Immediate Action: Update the Discourse platform to versions 2025.12.2, 2026.1.1, or 2026.2.0, which contain the necessary authorization filters to prevent unauthorized access to private fields.

Proactive Monitoring: Review web server access logs for anomalous requests to the /directory_items.json endpoint containing the user_field_ids parameter, particularly from unknown or suspicious IP addresses.

Compensating Controls: If immediate patching is not possible, site administrators should remove sensitive information from custom user fields or restrict directory access at the network or application level to prevent unauthorized retrieval.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for mass data exfiltration, administrators must prioritize this update. Applying the provided patches is the only definitive way to close the authorization gap and ensure that private user data remains protected from unauthorized access.