Unrated severityNVD Advisory· Published Feb 26, 2026· Updated Feb 26, 2026
Discourse: TL4 users are able to change status of restricted topics
CVE-2026-26979
Description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Affected products
1- Range: < 2025.12.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/discourse/discourse/security/advisories/GHSA-9c7p-fqc5-c24fmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.