CVE-2026-55103: Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening

Published Oct 15, 2026

Updated

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

Affected Software

1 affected component

Discourse Discourse ActivityPub

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Discourse ActivityPub to a version that resolves this vulnerability.
Patch 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5

Event History

Oct 15, 2026

CVE Published

via MITRE·05:05 PM

Data Sourced

via MITRE·05:05 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Discourse installations using the Discourse ActivityPub component are affected if they are running a revision prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

Does exploitation require an account or user interaction?

No. The vulnerability is remotely exploitable and the supplied vector indicates that it requires neither attacker privileges nor user interaction.

What can an attacker do through this flaw?

An attacker can exploit missing validation of the signed-request actor and post ownership to edit, delete, or reply to federated posts without the required permissions.

What is the available fix?

Update to a version or revision that includes commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, which adds the required identity and ownership checks.