PT-2026-22186 · Discourse · Discourse

Davidtaylorhq · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-27151

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description Discourse, an open source discussion platform, had an issue where the move posts action did not properly validate write permissions on the destination topic. Specifically, the system only checked can move posts? on the source topic, failing to verify if the user had the necessary permissions to write to the destination topic. This allowed Trust Level 4 users and category group moderators to move posts into topics within categories where they lacked posting privileges, such as read-only categories or those with group-restricted write access.

Recommendations Update Discourse to version 2025.12.2 or later. Update Discourse to version 2026.1.1 or later. Update Discourse to version 2026.2.0 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2026-27151

CVE-2026-27151

GHSA-M69H-9M2G-CFGW

Affected Products

Discourse

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27151.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-m69h-9m2g-cfgw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27151 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-27151 · Vendor Advisory
• https://t.me/CVEtracker/45870 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028684551296282783 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027257128319119773 · Twitter Post
• https://twitter.com/CVEnew/status/2028683870858809407 · Twitter Post