{"id":"CVE-2026-53960","aliases":["BIT-discourse-2026-53960","EUVD-2026-60238","GHSA-j5j7-w5g3-43q8"],"status":"published","title":"Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00313,"percentile":0.24517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-08-17T15:33:14Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"Bitnami","package":"discourse","fixed_in":["2026.1.6","2026.5.2","2026.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"discourse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2026.1.6"},{"introduced":"2026.5.0"},{"fixed":"2026.5.2"},{"introduced":"2026.6.0"},{"fixed":"2026.6.1"}]}]}],"products":[{"vendor":"discourse","product":"discourse"}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-j5j7-w5g3-43q8","tags":["x_refsource_CONFIRM","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53960","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53960.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-53960","title":"Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","status":"published","published":"2026-08-17T15:33:14.312Z","modified":"2026-08-17T15:48:08.227Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-60238","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","status":"published","published":"2026-08-17T15:33:14Z","modified":"2026-08-17T15:48:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:49.335011Z"}],"nvd":[{"id":"CVE-2026-53960","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","status":"published","published":"2026-08-17T16:16:58.423Z","modified":"2026-09-18T20:09:01.757Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:38.647684Z"}],"osv":[{"id":"CVE-2026-53960","title":"Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","status":"published","published":"2026-08-17T15:33:14.312Z","modified":"2026-10-28T02:30:35.682143757Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"BIT-discourse-2026-53960","title":"Discourse: Hidden first-post excerpt is emitted in Q\u0026A schema JSON-LD","description":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q\u0026A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.","status":"published","published":"2026-08-21T11:26:33.15Z","modified":"2026-10-05T14:30:05.487413448Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}