CVE-2026-26979

0.0 infoEPSS 0.2%

Info (0.0) in discourse discourse. EPSS 0.2% chance of exploitation in the next 30 days.

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Severity

CVSS 4.0

0.0 none

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2026-02-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

discourse:discourse

References

https://github.com/discourse/discourse/security/advisories/GHSA-9c7p-fqc5-c24f

Check your stack JSON