PT-2026-22176 · Discourse · Discourse

Davidtaylorhq · CVE-2026-26979 · Publicado 2026-02-26 · Atualizado 2026-03-03

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Baixa

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, Trust Level 4 (TL4) users were able to perform actions such as closing, archiving, and pinning topics within private categories to which they did not have explicit access.

Recommendations Update Discourse to version 2025.12.2 or later. Update Discourse to version 2026.1.1 or later. Update Discourse to version 2026.2.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

BIT-DISCOURSE-2026-26979

CVE-2026-26979

GHSA-9C7P-FQC5-C24F

Produtos afetados

Discourse

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26979.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-9c7p-fqc5-c24f · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2027131697704116277 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26979 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-discourse-2026-26979 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027466664535826883 · Publicação no Twitter
• https://t.me/CVEtracker/45883 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2027467964484653172 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-26979 · Aviso do Fabricante