Home

Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

PUBLISHED Reserved 2026-02-18 | Published 2026-02-26 | Updated 2026-02-26 | Assigner GitHub_M




LOW: 1.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Problem types

CWE-862: Missing Authorization

Product status

< 2025.12.2
affected

>= 2026.1.0-latest, < 2026.1.1
affected

>= 2026.2.0-latest, < 2026.2.0
affected

References

github.com/...course/security/advisories/GHSA-m69h-9m2g-cfgw

cve.org (CVE-2026-27151)

nvd.nist.gov (CVE-2026-27151)

Download JSON