Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
Discourse Platform: Unsecured Note Access for Category Moderators
CVE-2026-26973
Summary
Certain versions of the Discourse discussion platform have a security issue affecting category moderators. They can access and modify notes for any reviewable, not just those in their category. To fix this, update to a patched version or disable category group moderation. This is only a risk for instances with this feature enabled.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| discourse | discourse | <= 2025.12.0 | – |
| discourse | discourse | > 2026.1.0 , <= 2026.1.1 | – |
| discourse | discourse | 2026.2.0 | – |
Original title
Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_cat...
Original description
Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped `Reviewable.find` and the `ensure_can_see` guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with `enable_category_group_moderation` enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through `Reviewable.viewable_by(current_user)`. As a workaround, disable the `enable_category_group_moderation` site setting. This removes the attack surface as only staff users will have access to the review queue.
nvd CVSS3.1
4.3
Vulnerability type
CWE-863
Incorrect Authorization
CWE-639
Authorization Bypass Through User-Controlled Key
Published: 26 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026