Discourse Discourse-Subscriptions Plugin Subscription Access Bypass Vulnerability

A vulnerability exists in the Discourse platform's discourse-subscriptions plugin, allowing users to access subscription-gated groups without making a payment. This issue is present in Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Impact

Exploitation of this vulnerability allows users to bypass payment requirements and gain unauthorized access to subscription-gated groups.

Remediation

Users can update to Discourse versions 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 to address this vulnerability. Alternatively, the discourse-subscriptions plugin can be disabled.