CVE-2026-29072

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users who do not belong to the allowed policy creation groups could create functional policy acceptance widgets in posts under certain conditions. The policy enabled site setting controls the functionality of the discourse-policy plugin.

Recommendations Versions prior to 2026.3.0-latest.1: Update to version 2026.3.0-latest.1 or later. Versions prior to 2026.2.1: Update to version 2026.2.1 or later. Versions prior to 2026.1.2: Update to version 2026.1.2 or later. As a workaround for all affected versions, disable the discourse-policy plugin by disabling the policy enabled site setting.