CVE-2026-27021: Discourse Information Disclosure Flaw

CVE-2026-27021 Overview

CVE-2026-27021 is an Authorization Bypass vulnerability affecting Discourse, an open source discussion platform. The voters endpoint in the poll plugin lacks proper post visibility checks, allowing unauthorized access to voter details of polls in any post. This vulnerability enables attackers to enumerate voter information from private or restricted posts without proper authentication or authorization.

Critical Impact
Unauthorized users can access voter details from polls across all posts, including private and restricted content, potentially exposing sensitive user participation data.

Affected Products

Discourse versions prior to 2025.12.2
Discourse versions prior to 2026.1.1
Discourse versions prior to 2026.2.0

Discovery Timeline

2026-02-26 - CVE-2026-27021 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27021

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the poll plugin's voters endpoint fails to implement proper access control checks. The core issue lies in the endpoint's design, which returns voter details without first validating whether the requesting user has permission to view the associated post. This architectural flaw allows any user, including unauthenticated visitors, to query voter information from polls embedded in posts they should not have access to, such as private messages, restricted category posts, or staff-only discussions.

The vulnerability impacts the confidentiality of user participation data. While poll results might be public, the identities of individual voters in private contexts are typically expected to remain confidential. An attacker exploiting this vulnerability could correlate voting patterns across restricted content, potentially revealing sensitive organizational decisions or private community discussions.

Root Cause

The root cause is a missing authorization check (CWE-862) in the poll plugin's voters endpoint. The endpoint processes requests to retrieve voter information without first verifying that the requesting user has the necessary permissions to view the parent post containing the poll. This oversight allows the endpoint to return voter data regardless of the post's visibility settings or access restrictions.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can directly query the voters endpoint with poll identifiers to retrieve voter information. The attack can be conducted remotely against any accessible Discourse instance running a vulnerable version. Since no special privileges are required, any anonymous user with network access to the Discourse server can exploit this vulnerability to enumerate voter details from restricted polls.

The vulnerability can be exploited by crafting HTTP requests to the poll plugin's voters endpoint. An attacker would need to know or enumerate poll identifiers, which can potentially be discovered through other API endpoints or by iterating through predictable ID patterns. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27021

Indicators of Compromise

Unusual API request patterns targeting poll-related endpoints from unauthenticated sources
High volume of requests to the voters endpoint with sequential or enumerated poll identifiers
Access to voter information from posts the requesting user has no legitimate access to
Anomalous data exfiltration patterns from the poll plugin API

Detection Strategies

Monitor web application logs for requests to poll voter endpoints that return data without corresponding post access
Implement rate limiting detection for endpoints that enumerate user participation data
Deploy web application firewall rules to detect and alert on suspicious poll API access patterns
Cross-reference voter endpoint access with post visibility permissions to identify unauthorized data retrieval

Monitoring Recommendations

Enable detailed logging for the poll plugin API endpoints
Configure alerts for high-frequency requests to voter enumeration endpoints
Monitor for unusual patterns of cross-user or cross-post poll data access
Review access logs for requests from anonymous or low-privilege accounts targeting restricted content

How to Mitigate CVE-2026-27021

Immediate Actions Required

Upgrade to Discourse version 2025.12.2, 2026.1.1, or 2026.2.0 immediately
Review poll voter access logs to identify potential exploitation attempts
Assess whether sensitive voter information may have been accessed from private polls
Notify affected users if unauthorized access to private poll data is confirmed

Patch Information

The vulnerability is addressed in Discourse versions 2025.12.2, 2026.1.1, and 2026.2.0. The patch adds proper post visibility checks to the poll plugin's voters endpoint, ensuring that only users with legitimate access to a post can retrieve voter details from polls contained within that post. Organizations should prioritize upgrading to one of these patched versions as the primary remediation measure. For additional details, see the GitHub Security Advisory.

Workarounds

No known workarounds are available for this vulnerability
Consider temporarily disabling the poll plugin if upgrading is not immediately possible
Restrict network access to the Discourse instance to trusted users while awaiting patch deployment
Monitor and audit poll endpoint access until the upgrade can be completed

bash

# Recommended remediation: Upgrade Discourse to a patched version
cd /var/discourse
git pull
./launcher rebuild app