CVE-2026-31805: Discourse has a poll authorization bypass via post_id array parameter
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass in the poll plugin allowed authenticated users to vote on, remove votes from, or toggle the open/closed status of polls they did not have access to. By passing postid as an array (e.g. postid[]=&postid[]=), the authorization check resolves to the accessible post while the poll lookup resolves to a different post's poll. This affects the vote, removevote, and togglestatus endpoints in DiscoursePoll::PollsController. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31805?
CVE-2026-31805 is classified as a medium severity vulnerability due to its potential impact on user authorization.
How do I fix CVE-2026-31805?
To fix CVE-2026-31805, update your Discourse installation to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.
What is the nature of the vulnerability identified in CVE-2026-31805?
CVE-2026-31805 is an authorization bypass vulnerability in the poll plugin of Discourse that allows unauthorized users to manipulate votes.
Which versions of Discourse are affected by CVE-2026-31805?
CVE-2026-31805 affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
Can I manage votes using the poll plugin if I am affected by CVE-2026-31805?
Yes, if your Discourse installation is affected by CVE-2026-31805, authenticated users may unfairly manage votes in polls.