Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A flaw in its subscription plugin allows users to pay for a low-cost membership tier but then manipulate the finalization process to grant themselves the benefits of a more expensive, higher-tier subscription. This could result in lost revenue for forum operators and unauthorized access to premium content or features.
Technical details
An improper authorization vulnerability exists in the discourse-subscriptions plugin's /s/finalize endpoint. The root cause is that the endpoint accepted client-supplied 'plan' and 'transaction' parameters to determine group membership after a Stripe payment. An attacker can initiate a low-cost subscription via the create method and then, during the 3D Secure authentication flow, call the finalize endpoint with a premium plan ID. This allows the attacker to be added to a higher-tier group than the one they paid for. The fix involves storing the plan and transaction IDs in a server-side session during the initial request and having the finalize endpoint read exclusively from that session.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, 2026.3.0-latest to before 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched