Discourse Privilege Escalation Vulnerability for Category Group Moderators

A vulnerability exists in Discourse that allows category group moderators to perform privileged actions on topics in private categories without having the necessary read access. This issue affects Discourse versions 2026.1.0-latest to prior to 2026.1.3, 2026.2.0-latest to prior to 2026.2.2, and 2026.3.0-latest to prior to 2026.3.0.

Impact

Exploitation of this vulnerability could lead to unauthorized moderation actions in private categories, bypassing normal access controls.

Reproduction

To reproduce this vulnerability, a user must be a category group moderator with access to private categories. The user can then perform moderation actions on topics in those categories without the required read access. This can be verified by checking the access permissions and the actions taken on the topics.

Remediation

Users are advised to upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0.