Unrated severityNVD Advisory· Published Feb 26, 2026· Updated Feb 28, 2026
Discourse: Poll voters endpoint lacked post visibility checks
CVE-2026-27021
Description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Affected products
1- Range: < 2025.12.2
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/discourse/discourse/security/advisories/GHSA-f5m5-9hpw-7c2gmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.