CVE-2026-53960

Discourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was leaked as an excerpt in the publicly-served Q&A (QAPage) JSON-LD structured data, exposing it to any unauthenticated visitor and to search-engine crawlers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

We have discovered 2,640 live websites that are affected by CVE-2026-53960.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains2,640 live websites (62% of Discourse install base)
Vulnerable Versions
  • from 0 through 2026.1.6
  • from 2026.5 through 2026.5.2
  • from 2026.6 through 2026.6.1
Vulnerable Versions Count62 versions ( 86% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 17, 2026
  • Updated - Aug 17, 2026

Website Distribution by Country

Number of websites using CVE-2026-53960
United States1,502 websites


Germany438 websites
France127 websites
Singapore70 websites
GB53 websites
China43 websites
Netherlands40 websites
Russia35 websites
Switzerland33 websites
Brazil22 websites

Website Distribution by TLD

Number of websites using CVE-2026-53960
.com1,101 websites
.org446 websites
.net151 websites
.io119 websites
.de88 websites
.fr35 websites
.ru28 websites
.nl21 websites
.ch20 websites
.co19 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-53960

Top websites that are affected by CVE-2026-53960. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
********.com United States**,***
*********.******.com GB**,***
******.********.com United States**,***
*********.******.com United States**,***
******.******.com United States**,***
*****.*************.com Germany***,***
******.********.org Germany***,***
******.*****.net United States***,***
*********.****.sh United States***,***
See full domain list

FAQ

CVE-2026-53960 is Missing Authorization in Discourse
A total of 2,640 websites have been identified as vulnerable to CVE-2026-53960, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2026-53960 vulnerability.
Discourse versions up to 2026.6.1 are vulnerable to CVE-2026-53960.
CVE-2026-53960 is resolved in version 2026.6.1 of Discourse.