CVE-2026-55704

Discourse: Shared-draft titles and excerpts leak through group post serialization

Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but were not permitted to see shared drafts, could still receive shared-draft entries through the group posts and group mentions endpoints. This could disclose shared-draft topic titles and post excerpt/content, resulting in an information disclosure of unpublished draft material. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

We have discovered 2,640 live websites that are affected by CVE-2026-55704.

Run a Free Instant Scan



Affected Software

Product  Discourse
Category Message Boards
Vulnerable Domains2,640 live websites (62% of Discourse install base)
Vulnerable Versions
  • from 0 through 2026.1.6
  • from 2026.5 through 2026.5.2
  • from 2026.6 through 2026.6.1
Vulnerable Versions Count62 versions ( 86% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Aug 17, 2026
  • Updated - Aug 17, 2026

Website Distribution by Country

Number of websites using CVE-2026-55704
United States1,502 websites


Germany438 websites
France127 websites
Singapore70 websites
GB53 websites
China43 websites
Netherlands40 websites
Russia35 websites
Switzerland33 websites
Brazil22 websites

Website Distribution by TLD

Number of websites using CVE-2026-55704
.com1,101 websites
.org446 websites
.net151 websites
.io119 websites
.de88 websites
.fr35 websites
.ru28 websites
.nl21 websites
.ch20 websites
.co19 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-55704

Top websites that are affected by CVE-2026-55704. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.org United States**,***
********.com United States**,***
*********.******.com GB**,***
******.********.com United States**,***
*********.******.com United States**,***
******.******.com United States**,***
*****.*************.com Germany***,***
******.********.org Germany***,***
******.*****.net United States***,***
*********.****.sh United States***,***
See full domain list

FAQ

CVE-2026-55704 is Missing Authorization in Discourse
A total of 2,640 websites have been identified as vulnerable to CVE-2026-55704, based on global website indexing conducted by WebTechSurvey.
The Discourse is affected by the CVE-2026-55704 vulnerability.
Discourse versions up to 2026.6.1 are vulnerable to CVE-2026-55704.
CVE-2026-55704 is resolved in version 2026.6.1 of Discourse.