CVE-2026-28227: low-severity vulnerability in discourse
Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Timer publish_to_category
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Discourse allows trusted users (TL4) to post topics in staff-only categories by using a scheduled topic timer feature, bypassing the intended access restrictions. This lets unauthorized users create content in restricted areas.
TL4 users can bypass authorization checks in Discourse by leveraging the `publish_to_category` topic timer mechanism to publish topics into staff-only categories. The vulnerability stems from insufficient permission validation during the topic timer execution, allowing privilege escalation to restricted content areas.
In the same product, most dangerous first.