Discourse Destination Topic Write Permission Vulnerability in Post Moving Action

A vulnerability exists in Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0, allowing TL4 users and category group moderators to move posts into topics in categories where they have no posting privileges. This issue arises because the 'move_posts' action only verifies the ability to move posts from the source topic, without checking write permissions for the destination topic. As a result, users can inadvertently place posts in read-only categories or those with group-restricted writing access.

Impact

Exploiting this vulnerability could lead to unauthorized post movements into categories where the user lacks posting rights, potentially disrupting category management and user discussions.

Remediation

Users are advised to upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0.