ZeroDay Findings
Sign inSign up

Findings

CVE-2026-28227

Discourse is an open source discussion platform.

Published Feb 26, 2026 · updated Jun 17, 2026 · discourse discourse

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 26, 2026 · NIST NVD

    Detected

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

  2. Jun 17, 2026 · NIST NVD

    Updated

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Affected

  • cpe discourse/discourseversion unspecified
  • cpe discourse/discourse2026.2.0

Sources

  • NIST NVDVulnerability recordCVE-2026-28227

    Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patc

    nvd.nist.gov

References