CVE-2026-27152

Katalog CVE

CVSS 3.8 · Low EPSS 0,27%

Kerentanan Improper Access Control pada discourse. Skor CVSS 3.1 3.8 (Low) menurut NVD.

Deskripsi (NVD)

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, DM communication-preference bypass when adding members via `Chat::AddUsersToChannel` — a user could add targets who have blocked/ignored/muted them to an existing DM channel, bypassing per-recipient PM restrictions that are enforced during DM channel creation. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Rincian

Terbit di NVD

26 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.8 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/discourse/security/advisories/GHSA-f8ff-pxg3-7967 advisory vendor