Discourse up to 2026.1.1/2026.2.0/2026.3.0-latest.1 post_id[] authorization

Summaryinfo

A vulnerability marked as problematic has been reported in Discourse up to 2026.1.1/2026.2.0/2026.3.0-latest.1. Impacted is an unknown function. Performing a manipulation of the argument post_id[] results in authorization. This vulnerability was named CVE-2026-31805. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Discourse up to 2026.1.1/2026.2.0/2026.3.0-latest.1. This affects an unknown code. The manipulation of the argument post_id[] with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality. The summary by CVE is:

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing post_id as an array (e.g. post_id[]=&post_id[]=), the authorization check resolves to the accessible post while the poll lookup resolves to a different post's poll. This affects the vote, remove_vote, and toggle_status endpoints in DiscoursePoll::PollsController. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-31805 since 03/09/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2026.1.2 or 2026.2.1 eliminates this vulnerability. Applying the patch 1a6b3cdd8939053f485a60a6ea004a40878392c4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Chat Software

Name

• Discourse

Version

• 2026.0
• 2026.1
• 2026.1.0
• 2026.1.1
• 2026.2.0
• 2026.3.0-latest.0
• 2026.3.0-latest.1

License

• open-source

Website

• Product: https://github.com/discourse/discourse/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion