Auth bypass in Discourse

CVE-2026-27936

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a restriction bypass allows restricted post action counts to be disclosed to non-privileged users through a carefully crafted req…

Vulnerability class: Broken Access Control

EPSS: 0.000 (6.9th percentile) — read the EPSS interpretation.