CVE-2026-26973

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `ReviewableNotesController`. When `enable_category_group_moderation` is enabled, a user belonging to a category moderation group can create or delete their own notes on **any** reviewable in the system, including reviewables in categories they do not moderate. The controller used an unscoped `Reviewable.find` and the `ensure_can_see` guard only checked whether the user could access the review queue in general, not whether they could access the specific reviewable. Only instances with `enable_category_group_moderation` enabled are affected. Staff users (admins/moderators) are not impacted as they already have access to all reviewables. The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by scoping the reviewable lookup through `Reviewable.viewable_by(current_user)`. As a workaround, disable the `enable_category_group_moderation` site setting. This removes the attack surface as only staff users will have access to the review queue.

• CWE-863
• CWE-639

• https://github.com/discourse/discourse/security/advisories/GHSA-c587-qx78-vhmxVendor Advisory

Published

Feb 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26963Cilium is a networking, observability, and security solution…5.4
• CVE-2026-26964Windmill is an open-source developer platform for internal c…2.7
• CVE-2026-26965FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2026-26967PJSIP is a free and open source multimedia communication lib…5.3
• CVE-2026-2697An Indirect Object Reference (IDOR) in Security Center allow…8.8
• CVE-2026-26972OpenClaw is a personal AI assistant. In versions 2026.1.12 t…6.7
• CVE-2026-26974Slyde is a program that creates animated presentations from …9.8
• CVE-2026-26975Music Assistant is an open-source media library manager that…8.8
• CVE-2026-26977Frappe Learning Management System (LMS) is a learning system…5.3
• CVE-2026-26978FreePBX is an open source IP PBX. In versions below 16.0.71 …8.6
• CVE-2026-26979Discourse is an open source discussion platform. Prior to ve…2.7
• CVE-2026-2698An improper access control vulnerability exists where an aut…6.5