Volerion logoVolerion
Volerion logoVolerion

Discourse Subscription Endpoint Ownership Check Vulnerability Allowing Takeover

Vulnerability

A vulnerability exists in Discourse subscription endpoints in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. These endpoints do not properly verify ownership before allowing changes, potentially leading to subscription takeovers.

Impact

Exploitation of this vulnerability could allow for unauthorized changes to subscriptions, potentially leading to subscription takeovers.

Remediation

Users can upgrade to Discourse versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 to address this vulnerability.

Added: Jan 28, 2026, 7:31 PM
Updated: Jan 28, 2026, 7:31 PM

Vulnerability Rating

Custom Algorithm
spread
2.4
impact
5.0
exploitability
2.9
remediation
7.7
relevance
2.4
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.