CVE-2026-28227: Discourse Authorization Bypass Vulnerability

CVE-2026-28227 Overview

CVE-2026-28227 is an authorization bypass vulnerability affecting Discourse, a popular open source discussion platform. This vulnerability allows Trust Level 4 (TL4) users to publish topics into staff-only categories via the publish_to_category topic timer, effectively bypassing the platform's authorization checks. While TL4 users have elevated privileges, they should not have the ability to post content into staff-restricted categories, making this a clear violation of the intended access control model.

Critical Impact

TL4 users can bypass authorization controls to publish content to staff-only categories, potentially exposing sensitive internal discussions or allowing unauthorized content in restricted areas.

Affected Products

• Discourse versions prior to 2025.12.2
• Discourse versions prior to 2026.1.1
• Discourse versions prior to 2026.2.0

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-28227 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28227

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), which occurs when a software system fails to properly verify that the requesting user has the required permissions to perform an action. In the context of Discourse, the publish_to_category topic timer feature allows users to schedule when a topic will be published to a specific category. The authorization logic for this feature fails to adequately validate whether the user has permission to publish to the target category.

Trust Level 4 users in Discourse have significant privileges, including the ability to edit posts, move topics, and perform various moderation tasks. However, access to staff-only categories is intended to be restricted exclusively to users with staff roles (moderators and administrators). The vulnerability allows TL4 users to abuse the topic timer functionality to bypass these restrictions.

Root Cause

The root cause of this vulnerability lies in insufficient authorization checks within the publish_to_category topic timer functionality. When a user schedules a topic to be published to a category using this timer, the system does not properly validate whether the user has permission to post to the target category. This allows TL4 users to specify staff-only categories as the publication target, effectively bypassing the category-level access controls that should prevent non-staff users from publishing content there.

Attack Vector

The attack vector is network-based and requires authentication with TL4 privileges. An attacker with TL4 access would:

1. Create or access a topic in a category they have normal access to
2. Set up a publish_to_category topic timer, specifying a staff-only category as the target
3. When the timer triggers, the topic is published to the staff-only category without proper authorization verification

This bypasses the intended security boundary between privileged community members (TL4) and actual staff members. The attack requires high privileges (TL4 status), which limits the pool of potential attackers, but the authorization bypass represents a significant design flaw in the access control implementation.

Detection Methods for CVE-2026-28227

Indicators of Compromise

• Topics appearing in staff-only categories from non-staff (TL4) users
• Unusual activity in topic timer logs showing attempts to publish to restricted categories
• Audit log entries showing topic publications to staff categories by users without staff roles

Detection Strategies

• Review Discourse audit logs for topic timer events targeting staff-only categories
• Monitor for topics created in staff categories by users without admin or moderator roles
• Implement alerting on any topic publication events in sensitive categories from non-staff accounts
• Cross-reference user trust levels against category publication events

Monitoring Recommendations

• Enable verbose logging for topic timer functionality in Discourse
• Set up automated monitoring for publications to staff-only categories
• Regularly audit the contents of staff categories to identify unauthorized posts
• Review topic timer configurations periodically for suspicious target categories

How to Mitigate CVE-2026-28227

Immediate Actions Required

• Upgrade Discourse to version 2025.12.2, 2026.1.1, or 2026.2.0 or later immediately
• Audit staff-only categories for any unauthorized topics that may have been published via this bypass
• Review topic timer configurations for any suspicious entries targeting restricted categories
• Consider temporarily restricting TL4 privileges or topic timer access until patching is complete

Patch Information

The Discourse development team has addressed this vulnerability in versions 2025.12.2, 2026.1.1, and 2026.2.0. The patch implements proper authorization checks in the publish_to_category topic timer functionality to ensure that users cannot publish topics to categories they don't have permission to access.

For detailed information about the fix, refer to the GitHub Security Advisory.

Workarounds

• No official workarounds are available according to the vendor advisory
• As a temporary measure, administrators could disable or restrict access to topic timer functionality
• Consider temporarily demoting TL4 users or restricting their access to timer features
• Implement additional monitoring of staff category publications until patching is complete

# Discourse upgrade commands
cd /var/discourse
./launcher rebuild app
# Verify version after upgrade
./launcher enter app
rails r "puts Discourse::VERSION::STRING"