Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allowed certain group moderators to perform administrative actions on topics within private categories that they were not authorized to view. This could lead to unauthorized modification of sensitive discussions or exposure of private topic metadata.
Technical details
An improper authorization vulnerability (CWE-285) exists in Discourse where category group moderators were granted excessive privileges. Specifically, these users could perform privileged actions on topics located within private categories, even if they lacked the necessary read permissions for those categories. The vulnerability stems from insufficient permission checks in the topic management logic. An attacker with moderator privileges could exploit this over the network without user interaction to manipulate topics they should not be able to access. The issue has been addressed in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0
Timeline
- 2026-03-31: advisory: Vendor advisory GHSA-pr9m-5hpq-wc57 published
- 2026-03-31: patched: Fix committed to main repository