{"id":"CVE-2026-110762","revision":"4e3b43395c1848bf9b2066ba7e6c8f5d","records":[{"revision":"4e3b43395c1848bf9b2066ba7e6c8f5d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110762","aliases":[],"title":"bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream","description":"bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums nested under private or hidden parents expose title, permalink and body via the BuddyPress activity stream and REST endpoint.","state":0,"publishedAt":"2026-10-14T18:47:38.054+00:00","modifiedAt":"2026-10-14T20:23:55.323+00:00","affected":[{"ecosystem":"https://github.com/bbpress/bbPress","name":"bbPress","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"bbPress\",\n                    \"product\": \"bbPress\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"collectionURL\": \"https://github.com/bbpress/bbPress\",\n                    \"packageURL\": \"pkg:github/bbpress/bbPress\",\n                    \"repo\": \"https://github.com/bbpress/bbPress\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7,"severity":"LOW"}],"references":["https://bbpress.org/blog/2026/09/bbpress-2-6-19-is-out/","https://github.com/bbpress/bbPress/commit/5dce23a0b23a22d32c45b96fd44588952b16fe8a","https://github.com/bbpress/bbPress/blob/04c6f1513c6ca34e849ca16015b7a08b3c15e753/src/includes/extend/buddypress/activity.php#L431","https://wordpress.org/plugins/bbpress/","https://www.vulncheck.com/advisories/bbpress-before-2.6.19-information-disclosure-via-buddypress-activity-stream"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110762","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110762","identifiers":["CVE-2026-110762"]},"retained":false,"historicalAffected":[]}],"coverage":[]}