What is the CVSS score of CVE-2026-30888?

CVE-2026-30888 has a CVSS 3.1 base score of 2.2 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-30888?

CVE-2026-30888 is a low-severity vulnerability in Discourse involving privilege management (CVSS 2.2).. A patch is available.

How to fix or mitigate CVE-2026-30888?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Discourse CVE-2026-30888

EUVD-2026-13488 LOW

Improper Privilege Management (CWE-269)

2026-03-20 security-advisories@github.com

Privilege Escalation Discourse

2.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.2 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.0-latest.1,2026.2.1,2026.1.2

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13488

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 03:15 nvd

LOW 2.2

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allow a moderator to edit site policy documents (ToS, guidelines, privacy policy) that they are explicitly prohibited from modifying. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

A privilege escalation vulnerability in Discourse allows moderators to edit site policy documents (Terms of Service, guidelines, privacy policy) despite explicit access restrictions, enabling unauthorized modification of critical site governance documents. This affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The vulnerability has a low CVSS score of 2.2 due to high attack complexity and privileged access requirement, but represents a clear integrity violation of role-based access controls.

Technical ContextAI

Discourse is an open-source discussion platform built on Ruby on Rails. The vulnerability stems from improper privilege enforcement in the authorization layer, classified under CWE-269 (Improper Access Control / Privilege Issues). Specifically, the vulnerability allows moderators to bypass access control checks that should restrict modification of site policy documents to administrators only. This is an authorization bypass rather than an authentication bypass—authenticated moderators with elevated privileges can perform actions outside their intended scope due to insufficient server-side permission validation on policy document endpoints.

RemediationAI

Immediately upgrade to patched versions: Discourse 2026.3.0-latest.1 or later, 2026.2.1 or later, or 2026.1.2 or later depending on the release series currently deployed. Follow the official Discourse upgrade documentation at https://github.com/discourse/discourse/security/advisories/GHSA-jj9p-p7m6-jq96. Since no workarounds are available, patching cannot be deferred. For organizations unable to patch immediately, implement strict role-based access control audits to identify and restrict moderator accounts to only their intended permissions, and monitor audit logs for unauthorized policy document modifications. Test patches in a staging environment before production deployment.