{"id":"CVE-2026-27491","aliases":["BIT-discourse-2026-27491","EUVD-2026-13190","GHSA-xq37-5fvf-4m4j"],"status":"published","title":"Discourse has a bypass of official warnings messages by non-staff users","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00346,"percentile":0.28584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-03-19T20:47:54Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Bitnami","package":"discourse","fixed_in":["2026.1.2","2026.2.1","2026.3.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"discourse","ranges":[{"type":"SEMVER","events":[{"introduced":"2026.1.0"},{"fixed":"2026.1.2"},{"introduced":"2026.2.0"},{"fixed":"2026.2.1"},{"introduced":"2026.3.0"},{"fixed":"2026.3.0"}]}]}],"products":[{"vendor":"discourse","product":"discourse"}],"references":[{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-xq37-5fvf-4m4j","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/discourse/discourse/commit/60a588f4da4ab0feceb2c44787d4261b4f8757be","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/discourse/discourse/commit/d3cb203feabc46d765ecb91f348613a2bd531b89","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/discourse/discourse/commit/f5fef73827da7520efc517357bd2a6bab35d7886","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27491","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27491.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-27491","title":"Discourse has a bypass of official warnings messages by non-staff users","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","status":"published","published":"2026-03-19T20:47:54.668Z","modified":"2026-03-20T20:20:00.79Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:48.826324Z"}],"euvd":[{"id":"EUVD-2026-13190","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","status":"published","published":"2026-03-19T20:47:54Z","modified":"2026-03-20T20:20:00Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:32.04432Z"}],"nvd":[{"id":"CVE-2026-27491","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","status":"published","published":"2026-03-19T21:17:09.09Z","modified":"2026-06-17T10:27:14.733Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:09.735529Z"}],"osv":[{"id":"CVE-2026-27491","title":"Discourse has a bypass of official warnings messages by non-staff users","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","status":"published","published":"2026-03-19T20:47:54.668Z","modified":"2026-10-28T02:30:48.529065759Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:00.180685Z"},{"id":"BIT-discourse-2026-27491","title":"Discourse has a bypass of official warnings messages by non-staff users","description":"Discourse is an open-source discussion platform. Prior to versions 2026.3.0, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpoint allowed non-staff users to issue warnings to other users. Warnings are a staff-only moderation feature. The vulnerability required the attacker to be a logged-in user and to send a specifically crafted request. No data exposure or privilege escalation beyond the ability to create unauthorized user warnings was possible. Versions 2026.3.0, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.","status":"published","published":"2026-03-27T07:09:52.198Z","modified":"2026-09-08T08:45:34.82093771Z","updated_at":"2026-11-02T15:28:29.152062Z"}]}}