PT-2026-26358 · Discourse · Discourse

Davidtaylorhq · Published 2026-03-19 · Updated 2026-03-22 · CVE-2026-27454

Positive Technologies · (AI Summary)

CVSS v3.1

5.3

Medium

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting the /posts/:id.json API endpoint with the version=X parameter bypassed authorization checks on post revisions. The display post method called post.revert to directly without verifying whether the revision was hidden or if the user had permission to view edit history. This allowed hidden revisions, intentionally concealed by staff, to be read by any user by enumerating version numbers. The vulnerable parameter is version.

Recommendations Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-27454

Affected Products

Discourse

References · 8

• https://github.com/discourse/discourse/security/advisories/GHSA-fq69-f929-wp96 · Vendor Advisory
• https://github.com/discourse/discourse/commit/8510fde30eb0d7f2dee822a95f6cf43b9ac943d0 · Patch
• https://github.com/discourse/discourse/commit/c0eeb5892f5d61ad62b057f4d468333a6e9f28c3 · Patch
• https://github.com/discourse/discourse/commit/c474fbd79d2bd231baafb4332970297d781f92ca · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27454 · Security Note
• https://twitter.com/CVEnew/status/2035627060370997361 · Twitter Post
• https://twitter.com/infoflowcloud/status/2035627910577500643 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034818530349088909 · Twitter Post