CVE-2026-26207 PUBLISHED

DIscourse's discourse-policy plugin lacks post access check

Assigner: GitHub_M
Reserved: 11.02.2026 Published: 26.02.2026 Updated: 26.02.2026

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, discourse-policy plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The PolicyController loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private categories or PMs they cannot see and any authenticated user to enumerate which post IDs have policies attached via differentiated error responses (information disclosure). The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by adding a guardian.can_see?(@post) check in the set_post before_action, ensuring post visibility is verified before any policy action is processed. As a workaround, disabling the discourse-policy plugin (policy_enabled = false) eliminates the vulnerability. There is no other workaround without upgrading.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS Score: 5.4

Product Status

Vendor discourse
Product discourse
Versions
  • Version < 2025.12.2 is affected
  • Version >= 2026.1.0-latest, < 2026.1.1 is affected
  • Version >= 2026.2.0-latest, < 2026.2.0 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE