Discourse Poll Manipulation Vulnerability in Private Topics

A vulnerability in Discourse allows users to interact with polls in private topics they no longer have access to. This issue affects Discourse versions 2026.1.0-latest to prior to 2026.1.3, 2026.2.0-latest to prior to 2026.2.2, and 2026.3.0-latest to prior to 2026.3.0. The vulnerability arises when users are removed from a private category group but can still vote and toggle poll status via the API, potentially modifying poll states inappropriately.

Impact

Exploitation of this vulnerability allows unauthorized users to manipulate poll interactions, such as voting and changing poll statuses, in private topics they should not have access to.

Reproduction

To reproduce this vulnerability, a user must be a member of a private category group with access to a topic that contains a poll. After interacting with the poll, the user can be removed from the group, which should revoke their access to the topic. However, the user can still toggle the poll status or vote in the poll via the Discourse API, indicating that the access control is not properly enforced.

Remediation

Users are advised to upgrade to Discourse versions 2026.1.3, 2026.2.2, or 2026.3.0.