Low severity3.8NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026
CVE-2026-27150
CVE-2026-27150
Description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing validate_before_create authorization in Data Explorer's QueryGroupBookmarkable allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure validate_before_create throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available.
Affected products
5cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*range: <2025.12.2
- cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*
- (no CPE)range: <2025.12.2, <2026.1.1, <2026.2.0
- (no CPE)range: < 2025.12.2
Patches
Vulnerability mechanics
References
1- github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8nvdVendor Advisory
News mentions
0No linked articles in our index yet.