HackerOne Disclosed Reports - 2026-10-10

Medium
resolved

Information Disclosure - Unauthen Leak Private Content

Bug reported by Truong Nguyen Long was disclosed at October 10, 2026, 5:55 pm   |   Information Disclosure

A vulnerability was discovered in the BuddyPress integration of a forum plugin where the hide_sitewide flag for new topic and reply activity was computed by checking only the posting forum's own status, not its parent forums. This allowed topics posted in a public-status subforum nested under a private or hidden parent forum to be broadcast in full to the public activity stream, including title, forum name, permalink, and body content. The content was disclosed despite the topic's direct permalink correctly returning a 404 error for unauthorized viewers. Unauthenticated users and low-privileged accounts were able to read restricted content via the public feed and API.