Discourse ActivityPub CVE-2026-55103

The target must run the discourse-activity-pub plugin with federation active and must host federated posts that can be referenced; exploitation occurs by delivering a validly HTTP-signed ActivityPub activity to the inbox or shared_inbox controller where the signed request actor differs from the declared Activity actor or does not own the attributed object. No account on the Discourse instance is required (PR:N), but the attacker must be able to produce a valid HTTP signature for some federated actor, and the limiting factor is that stock Discourse does NOT ship this plugin - only instances that have installed and enabled ActivityPub federation are exposed.

Signals are moderately strong but internally inconsistent, so judgment is required. The input CVSS of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C describes a network-reachable, low-complexity, unauthenticated attack with changed scope - all consistent with a remote actor abusing the ActivityPub inbox endpoints. However, the CVSS impact metrics (C:H/I:N/A:N) directly CONTRADICT the description: the flaw lets an attacker 'edit, delete, or reply to federated posts,' which is an INTEGRITY/tampering impact, not confidentiality - the vector appears mis-scored and the 'Information Disclosure' tag is likewise wrong. CWE-345 (insufficient verification of data authenticity) correctly fits the root cause: inbound processing never checked that the HTTP-signature actor matched the Activity actor and owned the referenced object. No EPSS score, no CISA KEV listing, and no public exploit were provided, so this is not confirmed as actively exploited; the only exploitation enabler is the public patch commit, which reveals the exact missing checks and could accelerate exploit development. Net assessment: a genuinely serious integrity/spoofing flaw for the subset of Discourse instances that run the ActivityPub plugin with federation enabled, but overall real-world risk is tempered by the plugin's limited deployment footprint and the absence of any exploitation evidence. Treat as a prompt-patch item for federating instances rather than an emergency fleet-wide priority.

An attacker operating any fediverse-capable server crafts an ActivityPub Update/Delete/Create activity whose declared actor or object attribution belongs to a victim, then signs the HTTP request with their own key and delivers it to the target Discourse instance's inbox or shared inbox. Because the pre-patch code never confirmed the signed actor matched the Activity actor or owned the object, the forged activity is processed, letting the attacker alter or remove another user's federated posts or inject replies in their name. No public exploit was identified at time of analysis, though the fix commit publicly discloses the exact missing identity and ownership checks.