Discourse Poll Plugin Post Visibility Vulnerability in Voters Endpoint

A vulnerability exists in the Discourse poll plugin, specifically in versions prior to 2025.12.2, 2026.1.1, and 2026.2.0. The issue arises because the voters endpoint did not implement proper post visibility checks. This oversight allowed unauthorized users to access details about voters in any poll post. The vulnerability could be exploited without any special requirements or privileges.

Impact

Exploitation of this vulnerability led to unauthorized access to voter details in polls, potentially allowing users to see how others voted in any post.

Remediation

Users can upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0 to address this vulnerability.