PT-2026-26542 · Discourse · Discourse

Jomaxro · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-31805

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. An authorization bypass in the poll plugin allowed authenticated users to perform actions on polls they were not authorized to access. This included voting, removing votes, and changing the open/closed status of polls. The issue occurred because the authorization check and poll lookup used different resolutions when the post id parameter was passed as an array (e.g., post id[]=&post id[]=). This affected the following API endpoints within the DiscoursePoll::PollsController:

• /vote
• /remove vote
• /toggle status The post id parameter is a vulnerable parameter.

Recommendations Update Discourse to version 2026.3.0-latest.1 or later. Update Discourse to version 2026.2.1 or later. Update Discourse to version 2026.1.2 or later.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-20

CWE-863

Related Identifiers

BIT-DISCOURSE-2026-31805

CVE-2026-31805

GHSA-FGXM-PRJV-G823

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31805.json · Exploit
• https://github.com/discourse/discourse/commit/1a6b3cdd8939053f485a60a6ea004a40878392c4 · Patch
• https://github.com/discourse/discourse/security/advisories/GHSA-fgxm-prjv-g823 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31805 · Security Note
• https://osv.dev/vulnerability/BIT-discourse-2026-31805 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2034913243798409329 · Twitter Post
• https://twitter.com/CVEnew/status/2034841425796599835 · Twitter Post