CVE-2026-34154

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.

• CWE-862

• https://github.com/discourse/discourse/security/advisories/GHSA-pjgj-7mjq-6j7gMitigation, Vendor Advisory

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34149Coolify is an open-source and self-hostable tool for managin…3.3
• CVE-2026-3415The XML and schema validation functionalities within the Sch…8.7
• CVE-2026-34150Wazuh is a free and open source platform used for threat pre…7.5
• CVE-2026-34151XWiki Platform is a generic wiki platform. Prior to 17.10.5 …8.2
• CVE-2026-34152Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34153Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34155RAUC controls the update process on embedded Linux systems. …5.3
• CVE-2026-34156NocoBase is an AI-powered no-code/low-code platform for buil…9.9
• CVE-2026-34158Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34159llama.cpp is an inference of several LLM models in C/C++. Pr…9.8
• CVE-2026-3416The API Publisher component previously used a non-cryptograp…7.5
• CVE-2026-34160Chamilo LMS is an open-source learning management system. In…8.6