CVE-2026-27454: Discourse Auth Bypass Vulnerability

CVE-2026-27454 Overview

CVE-2026-27454 is an authorization bypass vulnerability in Discourse, the popular open-source discussion platform. The vulnerability exists in the post revision viewing functionality where requesting /posts/:id.json?version=X bypassed critical authorization checks on post revisions. This allowed any authenticated or unauthenticated user to access hidden post revisions by simply enumerating version numbers.

Critical Impact
Attackers can access hidden post revisions that were intentionally concealed by staff members, potentially exposing sensitive information that was edited out of posts, including personal data, confidential discussions, or mistakenly published content.

Affected Products

Discourse versions prior to 2026.3.0-latest.1
Discourse versions prior to 2026.2.1
Discourse versions prior to 2026.1.2

Discovery Timeline

2026-03-19 - CVE CVE-2026-27454 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-27454

Vulnerability Analysis

The vulnerability stems from a Missing Authorization check (CWE-862) in the display_post method within app/controllers/posts_controller.rb. When a user requested a post with a specific version parameter via the /posts/:id.json?version=X endpoint, the application called post.revert_to directly without performing any authorization verification.

This implementation flaw created an inconsistency in the authorization model. While the /posts/:id/revisions/:revision endpoint properly authorized access through the guardian system, the posts endpoint with version parameter completely bypassed these security controls. Staff members could hide post revisions for various reasons—removing accidentally published sensitive information, correcting inappropriate content, or protecting user privacy—but this vulnerability rendered those protections ineffective.

An attacker could enumerate version numbers starting from 0 and incrementally request each version to extract all hidden revisions. This requires no authentication and can be automated trivially, making mass exploitation straightforward.

Root Cause

The root cause is a missing authorization check in the display_post method. The vulnerable code directly called post.revert_to(params[:version].to_i) when a version parameter was present, without first looking up the corresponding PostRevision record and validating user permissions via the guardian system. This oversight allowed the authorization layer to be completely bypassed when accessing post revisions through this alternative code path.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

Identifying a post ID on a Discourse forum
Crafting a request to /posts/:id.json?version=0
Incrementing the version number to enumerate all revisions
Extracting hidden revision content that was meant to be concealed

The following code shows the security patch applied to fix the vulnerability:

ruby

# Patched display_post method from app/controllers/posts_controller.rb
def display_post(post)
  if params[:version].present?
    version = params[:version].to_i
    post_revision = PostRevision.find_by(post_id: post.id, number: version + 1)
    if post_revision
      guardian.ensure_can_see!(post_revision)
      post.revert_to(version)
    end
  end
  render_post_json(post)
end

Source: GitHub Commit Fix

Detection Methods for CVE-2026-27454

Indicators of Compromise

Unusual volume of requests to /posts/:id.json endpoints with sequential version parameters
Access logs showing enumeration patterns (version=0, version=1, version=2, etc.) from single IP addresses
Requests for post revisions from users who should not have staff-level permissions

Detection Strategies

Monitor web server access logs for patterns of sequential version parameter requests to the posts JSON endpoint
Implement rate limiting on the /posts/:id.json endpoint to slow enumeration attempts
Create SIEM rules to alert on multiple requests with incrementing version parameters from the same source

Monitoring Recommendations

Enable detailed request logging for Discourse API endpoints, particularly those handling post revisions
Configure alerts for anomalous access patterns to revision-related endpoints
Review access logs for historical exploitation attempts if running a vulnerable version

How to Mitigate CVE-2026-27454

Immediate Actions Required

Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later immediately
Review web server logs for evidence of exploitation attempts
If exploitation is suspected, audit which hidden revisions may have been accessed and assess the sensitivity of exposed content

Patch Information

Discourse has released security patches in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The fix ensures that the display_post method now looks up the PostRevision record and calls guardian.ensure_can_see! before allowing the revision content to be returned, consistent with the existing authorization model used by the /posts/:id/revisions/:revision endpoint.

For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

No known workarounds are available for this vulnerability; upgrading to a patched version is the only mitigation
Consider temporarily restricting access to your Discourse instance if immediate patching is not possible
Web application firewalls may be able to block requests with the version parameter, but this could break legitimate functionality

bash

# Example upgrade command for Discourse Docker installation
cd /var/discourse
./launcher rebuild app