CVE-2026-27151— Discourse doesn't validate destination topic when moving posts
Quick assessment
Affected
discourse discourse
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Discourse是Discourse开源的一套开源的社区讨论平台。该平台包括社区、电子邮件和聊天室等功能。 Discourse 2025.12.2之前版本、2026.1.1之前版本和2026.2.0之前版本存在安全漏洞，该漏洞源于move_posts操作仅检查源主题权限而未验证目标主题写入权限，可能导致用户将帖子移动到无权限类别。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-27151
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Discourse doesn't validate destination topic when moving posts
Source: CVE Program / CVE List V5
Vulnerability Description
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Discourse 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Discourse是Discourse开源的一套开源的社区讨论平台。该平台包括社区、电子邮件和聊天室等功能。 Discourse 2025.12.2之前版本、2026.1.1之前版本和2026.2.0之前版本存在安全漏洞，该漏洞源于move_posts操作仅检查源主题权限而未验证目标主题写入权限，可能导致用户将帖子移动到无权限类别。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-27151
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-27151
请登录查看更多情报信息。
Same Patch Batch · discourse · 2026-02-26 · 17 CVEs total
| CVE-2026-26265 | 7.5 HIGH | Discourse has IDOR vulnerability in the directory items endpoint |
| CVE-2026-26078 | 7.5 HIGH | Discourse has authentication bypass vulnerability in the Patreon plugin webhook endpoint |
| CVE-2026-26077 | 6.5 MEDIUM | Discourse doesn't ensure webhooks require a token |
| CVE-2026-26207 | 5.4 MEDIUM | DIscourse's discourse-policy plugin lacks post access check |
| CVE-2026-26973 | 4.3 MEDIUM | Discourse doesn't scope reviewable notes to user-visible reviewables |
| CVE-2026-28227 | Discourse Vulnerable to Unauthorized Topic Creation in Staff-Only Categories via Topic Tim | |
| CVE-2026-28219 | Privilege Escalation via Mass Assignment Allows Regular Users to Set Topics as Global Bann | |
| CVE-2026-28218 | Discourse's Fail-Open Access Control in Data Explorer Plugin Allows Unauthorized SQL Query | |
| CVE-2026-27154 | Discourse has XSS when editing a malicious post | |
| CVE-2026-27153 | Discourse doesn't prevent moderators from exporting user Chat DMs | |
| CVE-2026-27152 | DIscourse has DM communication-preference bypass when adding members | |
| CVE-2026-27162 | DIscourse doesn't prevent whispers to leak in excerpts | |
| CVE-2026-27150 | Discourse doesn't ensure guardian check when creating QueryGroupBookmark | |
| CVE-2026-27149 | Discourse has SQL injection in PM tag filtering | |
| CVE-2026-27021 | Discourse: Poll voters endpoint lacked post visibility checks | |
| CVE-2026-26979 | Discourse: TL4 users are able to change status of restricted topics |
IV. Related Vulnerabilities
Same product: discourse
-
CVE-2026-91119
Discourse: Encode action_code_who in mention URLs -
CVE-2026-91121
Discourse: Chat upload filenames rendered as raw HTML in exc -
CVE-2026-91120
Discourse: Stored HTML injection in video notification email -
CVE-2026-91132
Discourse: Wildcard iframe origin allowlist bypass via autho -
CVE-2026-91122
Discourse: Chat MessageBus delivers read-restricted messages
Same vendor: discourse
-
CVE-2026-91119
Discourse: Encode action_code_who in mention URLs -
CVE-2026-91121
Discourse: Chat upload filenames rendered as raw HTML in exc -
CVE-2026-91120
Discourse: Stored HTML injection in video notification email -
CVE-2026-91132
Discourse: Wildcard iframe origin allowlist bypass via autho -
CVE-2026-91122
Discourse: Chat MessageBus delivers read-restricted messages
Same weakness: CWE-862
-
CVE-2026-106041
Mooncake Store through 0.3.13.post1 Missing Authorization vi -
CVE-2026-106040
Mooncake Store through 0.3.13.post1 Missing Authorization vi -
CVE-2026-106039
Mooncake Store through 0.3.13.post1 Missing Authorization in -
CVE-2026-105059
WordPress Delete All Comments of wordpress plugin <= 7.1 - B -
CVE-2026-104406
WordPress picu plugin <= 3.10.1 - Broken Access Control vuln
V. Comments for CVE-2026-27151
No comments yet