Description
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checking for ownership before making changes. This issue is patched in versions 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. No known workarounds are available.
CVSS Metrics
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
- Attack Vector
- network
- Complexity
- low
- Privileges
- low
- User Action
- none
- Scope
- unchanged
- Confidentiality
- high
- Integrity
- low
- Availability
- none
- Weaknesses
- CWE-862
Metadata
- Primary Vendor
- DISCOURSE
- Published
- 1/28/2026
- Last Modified
- 1/30/2026
- Source
- NIST NVD
- Note: Verify all details with official vendor sources before applying patches.
Affected Products
discourse : discoursediscourse : discoursediscourse : discoursediscourse : discourse
AI-Powered Remediation
Generate remediation guidance or a C-suite brief for this vulnerability.