Discourse Group Notification Level Modification Vulnerability

A vulnerability exists in Discourse, an open-source discussion platform, allowing staff to change any user's group notification level. This issue is present in versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The vulnerability has been patched in the mentioned versions, but no workarounds are available.

Impact

Exploitation of this vulnerability allows staff to arbitrarily modify users' group notification levels, potentially leading to unauthorized changes in user engagement or visibility within discussions.

Remediation

Users can upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 to address this vulnerability.