Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-27021 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility ch… https://www.cve.org/CVERecord?id=CVE-2026-27021
Post summary
The text announces CVE-2026-27021, noting a visibility issue in Discourse's poll plugin voters endpoint before specific versions, but provides no PoC, exploit, or patch details.
CVE-2026-27021 Unauthorized Poll Voter Details Access in Discourse Before 2025.12.2, 2026.1.1, 2026.2.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27021
Post summary
The text announces CVE‑2026‑27021, describing unauthorized access to poll voter details in Discourse before specific version releases, without mentioning exploits, patches, or active attacks.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.2.0 | - | - |