Discourse EUVD-2026-17557

CVSS 6.3 with CVSS:4.0 vector indicates network-accessible, low-complexity attack with no privilege requirement but low integrity impact and attack time of P (persistent). The vulnerability is authenticated in practice (users must have had prior topic access to exploit), even though CVSS PR:N appears to classify it as unauthenticated-this discrepancy reflects that attackers need a valid user session from when they held group membership. EPSS exploitation probability data is not provided, and no KEV (CISA Known Exploited Vulnerability) status is reported, suggesting limited real-world active exploitation at disclosure. The integrity-only impact (VI:L) means attackers cannot read topic content or cause availability harm, reducing urgency compared to confidentiality or availability breaches. However, state manipulation of polls-even in topics users should not access-represents a moderate integrity violation and could enable social engineering or data manipulation in sensitive discussion spaces. The risk is elevated if Discourse instances use polls for sensitive decision-making (voting, surveys) within private groups.

An authenticated Discourse user with an active session accesses a private topic while a member of a category group. The group membership is subsequently revoked by an administrator. However, the user retains their session token and can still send HTTP requests to the poll endpoint (e.g., POST /polls/vote or /polls/toggle-status) without re-authorization. The attacker manipulates poll results by voting or changing poll open/closed status, affecting the integrity of group discussions or decisions reliant on those polls. No network reconnaissance or social engineering is required-only a valid historical session and knowledge of poll IDs, making exploitation feasible for motivated users aware of their access revocation.