PT-2026-22183 · Discourse · Discourse

Davidtaylorhq · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-27021

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description Discourse is an open source discussion platform. Before versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint within the poll plugin did not have adequate checks for post visibility. This allowed unauthorized access to voter details associated with polls in any post. The voters endpoint is the component affected. No known workarounds are available.

Recommendations Upgrade to Discourse version 2025.12.2 or later. Upgrade to Discourse version 2026.1.1 or later. Upgrade to Discourse version 2026.2.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2026-27021

CVE-2026-27021

GHSA-F5M5-9HPW-7C2G

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27021.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-f5m5-9hpw-7c2g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27021 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27021 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-27021 · Vendor Advisory
• https://t.me/CVEtracker/45867 · Telegram Post
• https://twitter.com/CVEnew/status/2027744260200513853 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027264807850721747 · Twitter Post