CVE-2026-28219 Details
Description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an improper authorization check in the topic management logic allows authenticated users to modify privileged attributes of their topics. By manipulating specific parameters in a PUT or POST request, a regular user can elevate a topic’s status to a site-wide notice or banner, bypassing intended administrative restrictions. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. There are no practical workarounds to prevent this behavior other than applying the security patch. Administrators concerned about unauthorized promotions should audit recent changes to site banners and global notices until the fix is deployed.
A vulnerability in Discourse prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, allows authenticated users to improperly modify certain attributes of their topics. This issue arises from an inadequate authorization check in the topic management process. By altering specific parameters in a PUT or POST request, a regular user can change a topic's status to a site-wide notice or banner, circumventing established administrative controls. There are no effective workarounds to address this issue, other than applying the available security patch. Administrators should review recent updates to site banners and global notices for unauthorized changes until the patch is implemented.
Users should update to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0. Instructions for updating Discourse can be found in the Discourse official documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-8v26-9f7h-jc8x | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| discourse discourse | < 2025.12.2 >= 2026.1.0, < 2026.1.1 2026.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 2, 2026 | Initial Analysis | [email protected] |
| Feb 26, 2026 | New CVE Received | [email protected] |