Discourse Privilege Escalation Vulnerability Allowing Email Change Bypass

A privilege escalation vulnerability has been identified in Discourse versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0. This vulnerability allows non-admin moderators to bypass restrictions on email changes, potentially leading to the takeover of non-staff accounts.

Impact

Exploitation of this vulnerability could result in unauthorized email changes, allowing non-admin moderators to take over non-staff accounts.

Remediation

Users can upgrade to Discourse versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0. As an alternative, the 'require_change_email_confirmation' setting can be enabled.