Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw allowed users who had been removed from private discussion groups to continue interacting with polls within those restricted areas. While unauthorized users could not read new messages, they could still cast votes or change the status of polls, potentially disrupting community decision-making or data integrity.
Technical details
An improper authorization vulnerability (CWE-285) exists in Discourse's poll plugin. The root cause is a missing 'guardian.can_see_topic?' check in the 'DiscoursePoll::Poll' component, which failed to verify a user's current permissions before processing poll actions. An attacker with a valid account who previously had access to a private category (e.g., via group membership) could continue to submit votes or toggle poll open/closed status via the API even after their access was revoked. This does not allow for unauthorized data retrieval (information disclosure) but does allow for unauthorized modification of poll states. The issue is fixed in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched