PT-2026-22197

CVE-2026-28227

Published

2026-02-26

Updated

2026-03-03

Description by

CVSS 3.1

2.7

Low

MetricsAV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2025.12.2 Discourse versions prior to 2026.1.1 Discourse versions prior to 2026.2.0

Description Discourse is an open source discussion platform. Trust Level 4 (TL4) users could publish topics into staff-only categories using the publish to category topic timer, bypassing intended authorization controls.

Recommendations Update to Discourse version 2025.12.2 or later. Update to Discourse version 2026.1.1 or later. Update to Discourse version 2026.2.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

34Selen

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers

CVE-2026-28227