CVE-2026-27454Disclosure(discourse / discourse)

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch discourse discourse systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The display_post method called post.revert_to directly without verifying whether the revision was hidden or if the user had permission to view edit history. This meant hidden revisions (intentionally concealed by staff) could be read by any user by simply enumerating version numbers. Starting in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, Discourse looks up the PostRevision and call guardian.ensure_can_see! before reverting, consistent with how the /posts/:id/revisions/:revision endpoint already authorizes access. No known workarounds are available.

discourse CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://github.com/discourse/discourse/security/advisories/GHSA-fq69-f929-wp96

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

discourse

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 1d ago at 2 mentions (2026-03-22); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

discourse

Products

discourse

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-20	1	Disclosure1
2026-03-22	2	Disclosure2
2026-09-15	1	Patch1

Full discourse4 posts

pdnuclei-bot@pdnuclei_bot24d
Patch
🚨 CVE-2026-27454 - medium 🚨 Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass > Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an author... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-27454 @pdnu...
Post summary
CVE-2026-27454 is a medium-severity hidden post revision disclosure vulnerability in Discourse via revert_to authorization bypass, with fixed versions identified (2026.1.2, 2026.2.1, 2026.3.0-latest.1) and a ProjectDiscovery link for further details. The tweet is truncated, limiting full context assessment.
02051428
1.3K followersView on X
Infoflowcloud@infoflowcloud201d
Disclosure
🚨*CVE* CVE-2026-27454 Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorizat… https://www.cve.org/CVERecord?id=CVE-2026-27454 ----- Traducción: CVE-2026-27454 Dis… http://infoflow.cloud`
Post summary
The post announces a newly disclosed authentication bypass in specific Discourse releases, but provides no exploit details, PoC, or patch information.
0000033
61 followersView on X
CVE@CVEnew201d
Disclosure
CVE-2026-27454 Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorizat… https://www.cve.org/CVERecord?id=CVE-2026-27454
Post summary
The tweet discloses CVE-2026-27454, identifying an authorization bypass in Discourse via the /posts/:id.json endpoint, and notes that versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain the patch.
00000342
56.8K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds203d
Disclosure
CVE-2026-27454 Authorization Bypass in Discourse Allowing Unauthorized Post Revision Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27454
Post summary
The text announces a new authorization bypass vulnerability (CVE-2026-27454) in Discourse that permits unauthorized access to post revisions; no patch, exploit, or PoC details are provided.
0000042
4.0K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	discourse	discourse	-	-	-
App	discourse	discourse	2026.3.0	-	-

Explore more

Back to dashboard discourse CVEs discourse vulnerabilities

What researchers are saying

CVE-2026-27454

pdnuclei-bot@pdnuclei_botPatch

CVE-2026-27454 is a medium-severity hidden post revision disclosure vulnerability in Discourse via revert_to authorization bypass, with fixed versions identified (2026.1.2, 2026.2.1, 2026.3.0-latest.1) and a ProjectDiscovery link for further details. The tweet is truncated, limiting full context assessment.

Infoflowcloud@infoflowcloudDisclosure

The post announces a newly disclosed authentication bypass in specific Discourse releases, but provides no exploit details, PoC, or patch information.

CVE@CVEnewDisclosure

The tweet discloses CVE-2026-27454, identifying an authorization bypass in Discourse via the /posts/:id.json endpoint, and notes that versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain the patch.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces a new authorization bypass vulnerability (CVE-2026-27454) in Discourse that permits unauthorized access to post revisions; no patch, exploit, or PoC details are provided.