Authorization Bypass in Discourse Open Source Discussion Platform
CVE-2026-28227

1.2LOW

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
26 February 2026

What is CVE-2026-28227?

Discourse, a widely used open source discussion platform, contains an authorization bypass vulnerability that allows TL4 users to publish topics in staff-only categories by exploiting the publish_to_category topic timer. This issue exists in versions prior to 2025.12.2, 2026.1.1, and 2026.2.0. The vulnerability circumvents critical authorization checks, raising significant security concerns. No workarounds are available for this issue, making it essential for users to upgrade to the patched versions to mitigate risks.

Affected Version(s)

discourse < 2025.12.2 < 2025.12.2

discourse >= 2026.1.0-latest, < 2026.1.1 < 2026.1.0-latest, 2026.1.1

discourse >= 2026.2.0-latest, < 2026.2.0 < 2026.2.0-latest, 2026.2.0

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
1.2
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.