Discourse Authorization Bypass Vulnerability in Hidden Solved Topics Allowing Unauthorized Solution Management

An authorization bypass vulnerability has been identified in Discourse, an open-source discussion platform. This vulnerability exists in hidden Solved topics and may allow unauthorized users to accept or unaccept solutions. It affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The issue arises from insufficient authorization checks, enabling unauthorized manipulation of solution statuses in certain topics.

Impact

Exploitation of this vulnerability could lead to unauthorized users being able to accept or unaccept solutions in hidden Solved topics, disrupting the intended authorization controls.

Remediation

Users can upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2, all of which contain the necessary patch. As an additional step, it is recommended to ensure that only trusted users are included in the Site Setting for accept_all_solutions_allowed_groups.