Discourse is an open source discussion platform.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the action only checked on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricte

2. Jun 17, 2026 · NIST NVD

   Updated

   Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the action only checked on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricte

Affected

• cpe discourse/discourseversion unspecified
• cpe discourse/discourse2026.2.0

Sources

• CVE.orgVulnerability recordCVE-2026-27151

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27151

  Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the action only checked on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category gro

  nvd.nist.gov

References

• Vendor Advisory · github.com