# CVE-2026-55103: Discourse ActivityPub authentication bypass in federated post operations

Source: https://junglewise.ai/threats/cve-2026-55103-discourse-activitypub-adds-activitypub-support-to-discourse-prior  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55103 · Severity: high · CVSS 8.6 · Published 2026-10-15

Discourse ActivityPub is a plugin that enables federated social networking features in Discourse discussion forums. An attacker can exploit missing authentication checks to edit, delete, or reply to posts belonging to other users without permission. This could allow unauthorized modification or deletion of forum content and impersonation of legitimate users.

Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-55103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55103 being exploited in the wild.

**How severe is CVE-2026-55103?** High severity, with a CVSS score of 8.6, published 15 October 2026.

**Which products and versions are affected?** Discourse ActivityPub plugin prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

**Is there a fix for CVE-2026-55103?** Yes: fixed in Versions after commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55103 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55103?** Check whether you run Discourse ActivityPub plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Versions after commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5

## Technical details

The vulnerability stems from insufficient verification of ActivityPub actor identity in inbound request processing. The plugin fails to verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post, allowing an attacker to forge ActivityPub messages. An unauthenticated remote attacker can perform unauthorized actions on federated content by sending crafted signed ActivityPub requests.

## Affected products

- Discourse ActivityPub plugin prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5

## Timeline

- 2026-06-16: disclosed
- 2026-06-16: patched
- 2026-10-15: advisory

## References

- [https://github.com/discourse/discourse-activity-pub/commit/1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5](https://github.com/discourse/discourse-activity-pub/commit/1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5)
- [https://github.com/discourse/discourse-activity-pub/security/advisories/GHSA-jw39-rch6-mhwf](https://github.com/discourse/discourse-activity-pub/security/advisories/GHSA-jw39-rch6-mhwf)