low2.7
CVE-2026-28227
Discourse is an open source discussion platform.
Impact
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users can publish topics into staff-only categories via the `publish_to_category` topic timer, bypassing authorization checks. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Discourse | Discourse | before 2025.12.2 from 2026.1.0 before 2026.1.1 Version 2026.2.0 |