Discourse Unauthorized Topic Creation in Staff-Only Categories Vulnerability

A vulnerability exists in Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0, allowing TL4 users to publish topics in staff-only categories. This is achieved through the 'publish_to_category' topic timer, which bypasses necessary authorization checks. The vulnerability arises from inadequate permission controls, enabling unauthorized access to restricted categories.

Impact

Exploitation of this vulnerability allows for unauthorized topic creation in staff-only categories, potentially leading to the dissemination of inappropriate or disruptive content within those spaces.

Remediation

Users can upgrade to Discourse versions 2025.12.2, 2026.1.1, or 2026.2.0 to address this vulnerability.