CVE-2026-27151: Discourse doesn't validate destination topic when moving posts
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the moveposts action only checked canmoveposts? on the source topic but never validated write permissions on the destination topic. This allowed TL4 users and category group moderators to move posts into topics in categories where they lack posting privileges (e.g., read-only categories or categories with group-restricted write access). Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27151?
CVE-2026-27151 has a medium severity rating due to the potential for unauthorized content movement within Discourse.
How do I fix CVE-2026-27151?
To fix CVE-2026-27151, update Discourse to versions 2025.12.2, 2026.1.1, or 2026.2.0 or later.
What does the vulnerability CVE-2026-27151 affect?
CVE-2026-27151 affects Discourse versions prior to 2025.12.2, 2026.1.1, and 2026.2.0.
Who is impacted by CVE-2026-27151?
CVE-2026-27151 primarily impacts TL4 users and category group moderators who can move posts.
What is the main issue with CVE-2026-27151?
The main issue with CVE-2026-27151 is that it allows users to move posts without validating permissions on the destination topic.