Auth bypass in Discourse

CVE-2026-29072

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users who do not belong to the allowed policy creation groups can create functional policy acceptance widgets in posts under the…

Vulnerability class: Broken Access Control

EPSS: 0.000 (5.1th percentile) — read the EPSS interpretation.