PT-2026-5210 · Discourse · Discourse

Davidtaylorhq · Published 2026-01-28 · Updated 2026-02-02 · CVE-2026-21865

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Moderators may be able to convert personal messages to public topics when they should not have access. As a temporary workaround, site administrators can revoke the moderation role from untrusted moderators or remove the moderator group from the "personal message enabled groups" site setting until the Discourse instance is upgraded to a patched version.

Recommendations Upgrade to Discourse version 3.5.4 or later. Upgrade to Discourse version 2025.11.2 or later. Upgrade to Discourse version 2025.12.1 or later. Upgrade to Discourse version 2026.1.0 or later. As a temporary workaround, revoke the moderation role from untrusted moderators. As a temporary workaround, remove the moderator group from the "personal message enabled groups" site setting.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BIT-DISCOURSE-2026-21865

CVE-2026-21865

GHSA-4777-WRV5-3G39

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21865.json · Exploit
• https://osv.dev/vulnerability/BIT-discourse-2026-21865 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21865 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21865 · Security Note
• https://github.com/discourse/discourse/security/advisories/GHSA-4777-wrv5-3g39 · Note
• https://twitter.com/CVEnew/status/2016608896413036574 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016704230078238793 · Twitter Post
• https://t.me/CVEtracker/43176 · Telegram Post