CVE-2026-26973: Discourse Auth Bypass Vulnerability

CVE-2026-26973 Overview

CVE-2026-26973 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Discourse, an open source discussion platform. The vulnerability exists in the ReviewableNotesController component and allows users belonging to a category moderation group to create or delete their own notes on any reviewable in the system, including reviewables in categories they do not have permission to moderate.

Critical Impact

When enable_category_group_moderation is enabled, category moderators can bypass access controls to manipulate reviewable notes across the entire system, potentially compromising content moderation integrity.

Affected Products

• Discourse versions prior to 2025.12.2
• Discourse versions prior to 2026.1.1
• Discourse versions prior to 2026.2.0

Discovery Timeline

• 2026-02-26 - CVE-2026-26973 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-26973

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization). The ReviewableNotesController in Discourse contains a broken access control flaw that fails to properly scope reviewable lookups to the authenticated user's authorized categories. The controller used an unscoped Reviewable.find method which retrieves any reviewable by ID without verifying the user's authorization to access that specific resource.

The ensure_can_see guard implemented in the controller only verified whether the user could access the review queue in general, rather than confirming access to the specific reviewable being manipulated. This creates a horizontal privilege escalation scenario where category moderators can exceed their intended scope of access.

Only Discourse instances with the enable_category_group_moderation site setting enabled are affected by this vulnerability. Staff users (administrators and moderators) are not impacted as they inherently have access to all reviewables system-wide.

Root Cause

The root cause is an authorization bypass stemming from insufficient access control validation. The ReviewableNotesController performed a general permission check rather than a resource-specific authorization check. The unscoped Reviewable.find call allowed any valid reviewable ID to be retrieved regardless of the authenticated user's category moderation scope, violating the principle of least privilege.

Attack Vector

The attack is network-based and requires low-privilege authenticated access. An attacker must have a valid account that belongs to a category moderation group. By manipulating the reviewable ID parameter in API requests to the ReviewableNotesController, the attacker can target reviewables outside their authorized categories.

The attacker can craft HTTP requests to the notes creation or deletion endpoints, substituting reviewable IDs that belong to categories they do not moderate. Since the controller only verifies general review queue access, these unauthorized operations succeed.

For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-26973

Indicators of Compromise

• Unusual note creation or deletion activity on reviewables by category moderators outside their assigned categories
• API requests to ReviewableNotesController endpoints containing reviewable IDs from unrelated categories
• Audit log entries showing category moderators accessing or modifying reviewables they should not have permission to view

Detection Strategies

• Monitor API access logs for patterns where category moderators interact with reviewables outside their moderation scope
• Implement application-level logging to track reviewable access attempts and correlate with user permissions
• Review Discourse audit logs for anomalous reviewer activity across category boundaries

Monitoring Recommendations

• Enable detailed logging for the ReviewableNotesController to capture all note creation and deletion operations
• Set up alerts for category moderators accessing reviewables in categories where they lack moderation privileges
• Regularly audit user permissions against activity logs to identify potential abuse patterns

How to Mitigate CVE-2026-26973

Immediate Actions Required

• Update Discourse to version 2025.12.2, 2026.1.1, or 2026.2.0 immediately
• If immediate patching is not possible, disable the enable_category_group_moderation site setting as a temporary workaround
• Review audit logs for any suspicious activity involving reviewable note modifications

Patch Information

The vulnerability is patched in Discourse versions 2025.12.2, 2026.1.1, and 2026.2.0. The fix implements proper scoping of the reviewable lookup by using Reviewable.viewable_by(current_user) instead of the unscoped Reviewable.find method. This ensures that users can only access reviewables they are explicitly authorized to view based on their category moderation assignments.

For additional details, see the GitHub Security Advisory.

Workarounds

• Disable the enable_category_group_moderation site setting to remove the attack surface entirely
• Restricting the review queue to staff users only eliminates the vulnerability until patching can be completed
• Consider temporarily removing users from category moderation groups if the site setting cannot be disabled

# Disable category group moderation via Rails console (workaround)
# Access the Discourse Rails console and run:
SiteSetting.enable_category_group_moderation = false