Discourse TL4 User Privilege Escalation Vulnerability in Private Categories
Vulnerability
A vulnerability exists in Discourse prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, allowing TL4 users to manipulate topics in private categories they do not have access to. Affected users could close, archive, and pin topics, misusing their privileges to interfere with discussions in restricted areas.
Impact
Exploitation of this vulnerability allows TL4 users to improperly manage topics in private categories, including closing, archiving, and pinning discussions, which could disrupt communication and organization within those categories.
Remediation
Users can upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0 to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.