Discourse up to 2025.12.1/2026.1.0 Group Member authorization

Summaryinfo

A vulnerability identified as critical has been detected in Discourse up to 2025.12.1/2026.1.0. Affected by this vulnerability is an unknown functionality of the component Group Member Handler. This manipulation causes authorization. This vulnerability is tracked as CVE-2026-26207. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Discourse up to 2025.12.1/2026.1.0 and classified as critical. Affected by this vulnerability is some unknown functionality of the component Group Member Handler. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private categories or PMs they cannot see and any authenticated user to enumerate which post IDs have policies attached via differentiated error responses (information disclosure). The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by adding a `guardian.can_see?(@post)` check in the `set_post` before_action, ensuring post visibility is verified before any policy action is processed. As a workaround, disabling the discourse-policy plugin (`policy_enabled = false`) eliminates the vulnerability. There is no other workaround without upgrading.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-26207 since 02/11/2026. The exploitation appears to be easy. The attack can be launched remotely. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2025.12.2, 2026.1.1 or 2026.2.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 2025.12.0
• 2025.12.1
• 2026.0
• 2026.1.0

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion