What is the CVSS score of CVE-2026-26973?

CVE-2026-26973 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-26973?

Organizations using Discourse should be aware of moderate risk from CVE-2026-26973, a incorrect authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-26973?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-26973

MEDIUM

Incorrect Authorization (CWE-863)

2026-02-26 security-advisories@github.com

Authentication Bypass Discourse

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Feb 26, 2026 - 20:31 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in ReviewableNotesController. When enable_category_group_moderation is enabled, a user belonging to a category moderation group can create or delete their own notes on any reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped Reviewable.find and the ensure_can_see guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with enable_category_group_moderation enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through Reviewable.viewable_by(current_user). As a workaround, disable the enable_category_group_moderation site setting. This removes the attack surface as only staff users will have access to the review queue.

AnalysisAI

Insecure Direct Object References in Discourse ReviewableNotesController allow category moderation group members to create or delete notes on any reviewable in the system regardless of moderation scope when category group moderation is enabled. This authorization bypass affects Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0, enabling users to manipulate moderation records outside their assigned categories. No patch is currently available.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Discourse. Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in ReviewableNotesController. When enable_category_group_moderation is enabled, a user belonging to a category moderation group can create or delete their own notes on any reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped Reviewable.find and the ensure_can_see guard only