Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-28227 Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the … https://www.cve.org/CVERecord?id=CVE-2026-28227
Post summary
CVE-2026-28227 reveals a privilege escalation flaw in Discourse that allows TL4 users to post in staff‑only categories. No PoC, exploit, patch, or active exploitation information is provided.
CVE-2026-28227 Discourse Authorization Bypass in Topic Timer for TL4 Users Before 2025.12.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28227
Post summary
The post announces CVE‑2026‑28227, an authorization bypass in Discourse’s Topic Timer affecting TL4 users on versions prior to 2025.12.2, with a link for further details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.2.0 | - | - |