CVE-2026-27454: Discourse has check revision visibility on posts endpoint
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The displaypost method called post.revertto directly without verifying whether the revision was hidden or if the user had permission to view edit history. This meant hidden revisions (intentionally concealed by staff) could be read by any user by simply enumerating version numbers. Starting in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, Discourse looks up the PostRevision and call guardian.ensurecansee! before reverting, consistent with how the /posts/:id/revisions/:revision endpoint already authorizes access. No known workarounds are available.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27454?
The severity of CVE-2026-27454 is considered to be moderate due to its potential to allow unauthorized access to post revisions.
How do I fix CVE-2026-27454?
To fix CVE-2026-27454, you should upgrade to Discourse versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.
What versions of Discourse are affected by CVE-2026-27454?
CVE-2026-27454 affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
What is the impact of CVE-2026-27454 on Discourse?
CVE-2026-27454 can bypass authorization checks on post revisions, potentially exposing sensitive content.
Is there a workaround for CVE-2026-27454 before applying the fix?
There are no known workarounds for CVE-2026-27454, so upgrading is the recommended action.