Discourse Activity Pub
Monthly
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.
Missing actor-identity and object-ownership checks in the Discourse ActivityPub plugin allow remote attackers to edit, delete, or reply to federated posts without the permissions those actions normally require. Because inbound ActivityPub processing trusts the Activity actor declared inside the payload rather than the actor authenticated by the request's HTTP signature, anyone who can produce a valid HTTP signature for any federated actor can operate on posts that actor does not own; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) confirms no account on the target Discourse instance is needed, with the impact being unauthorized modification rather than data exposure. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), though the fixing commit is publicly visible and the affected CPE entry spans all plugin versions prior to that commit. Exposure is limited to Discourse instances that have installed and enabled the ActivityPub federation plugin, since stock Discourse does not ship it.