Authentication Bypass in Discourse ActivityPub Plugin
CVE-2026-55103

8.6HIGH

Key Information:

Vendor

Discourse
Status
Discourse-activity-pub
Vendor
CVE Published:
15 October 2026

What is CVE-2026-55103?

The Discourse ActivityPub plugin introduced a vulnerability due to inadequate verification of the actor in signed requests. Prior to a key commit, this weakness allowed remote attackers to modify or delete federated posts, and to respond to them without proper authorization. The issue has been addressed in a subsequent update ensuring that incoming requests correctly match the authenticated user with their respective content.

Affected Version(s)

discourse-activity-pub < 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5

References

https://github.com/discourse/discourse-activity-pub/secur...
x_refsource_CONFIRM
https://github.com/discourse/discourse-activity-pub/commi...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.