VulnSocial

CVE-2026-27151General(discourse / discourse)

LOWCVSS 2.7 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch discourse discourse systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

discourse CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-03-03)
  • 3 total mentions across 2 days

Affected systems

Vendors
discourse
Products
discourse

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-02-27: 1Mentions · 2026-03-03: 2Patch / Workaround · 2026-03-03: 1Technical Details · 2026-03-03: 202-2703-03
Signal classification3 categories
General
133.3%
Disclosure
133.3%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-02-271
General1
2026-03-032
Disclosure1Patch1
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Patch

    🚨*CVE* CVE-2026-27151 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the so… https://www.cve.org/CVERecord?id=CVE-2026-27151 ----- Traducción: CVE-2026-27151 Dis… http://infoflow.cloud`

    Post summary

    The tweet announces CVE‑2026‑27151, noting a missing permission check in Discourse’s move_posts action and indicating that versions 2025.12.2, 2026.1.1, and 2026.2.0 contain the fix.

    0000034
    55 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-27151 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the so… https://www.cve.org/CVERecord?id=CVE-2026-27151

    Post summary

    The text references CVE‑2026‑27151, noting a flaw in Discourse’s move_posts action that only checks can_move_posts? before specific versions, but it provides no PoC, exploit, or patch details.

    00000325
    56.6K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-27151 Discourse Post Movement Vulnerability Allows Unauthorized Topic Modification https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27151

    Post summary

    The post references CVE-2026-27151 but offers no further details or actionable information.

    0000040
    4.0K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2026.2.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities