Discourse Subscriptions CVE-2026-34154

Exploitation requires that the target Discourse instance has the discourse-subscriptions plugin installed and has at least one group configured as subscription-gated (paid membership). The CVSS AT:P (Attack Requirements: Present) explicitly encodes this precondition. Active user interaction is required (UI:A), meaning the attacker must themselves engage with the subscription flow - this cannot be triggered passively or against another user. High attack complexity (AC:H) further limits exploitation to actors who understand the plugin's internal payment authorization sequence. Exploitation is bounded to gaining unauthorized group membership; there is no code execution, no privilege escalation, and no impact on other users or the underlying host system.

The CVSS 4.0 base score of 2.1 accurately reflects the constrained real-world risk of this finding. The vector AV:N/AC:H/AT:P/PR:N/UI:A signals network reachability but demands high attack complexity, a specific deployment precondition (AT:P - subscriptions plugin with paid groups), and active user interaction (UI:A), all of which substantially narrow the exploitable population. Impact is limited to low confidentiality on the vulnerable system (VC:L) with no integrity or availability effects and no subsequent system impact. No EPSS score was provided in the intelligence data, and the vulnerability is not listed in the CISA KEV catalog. No public proof-of-concept code has been identified. Despite the 'Authentication Bypass' tag, the CVSS PR:N indicates the actor does not need pre-existing credentials - however, the UI:A and AC:H requirements mean exploitation is neither trivial nor fully automated. In practical terms, this is a low-priority business-logic flaw affecting monetization integrity rather than system security.

An attacker navigates the Discourse subscription enrollment flow and manipulates the client-side or in-flight request sequence to signal payment completion without actually processing a transaction. The missing server-side authorization check (CWE-862) then grants the attacker membership in the subscription-gated group, giving them access to restricted content or features without paying. No public proof-of-concept has been identified at time of analysis, but the business-logic nature of the flaw means exploitation likely requires understanding of the plugin's payment flow rather than a memory corruption or injection primitive.