Discourse is an open source discussion platform.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Feb 26, 2026 · NIST NVD

   Detected

   Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

2. Jun 17, 2026 · NIST NVD

   Updated

   Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use to properly filter post types based on user permissions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Affected

• cpe discourse/discourseversion unspecified
• cpe discourse/discourse2026.2.0

Sources

• CVE.orgVulnerability recordCVE-2026-27162

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-27162

  Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, was checking topic access but then returning all posts regardless of type, including whispers that should only be visible to whisperers. Use `Post.secured(guardian

  nvd.nist.gov

References

• Vendor Advisory · github.com