/Vulnerability Library

Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization Bypass

CVE-2026-27454
Verified

Description

Discourse versions before 2026.1.2, 2026.2.1, and 2026.3.0-latest.1 contain an authorization bypass in PostsController#display_post. The controller calls post.revert_to(params[:version]) directly whenever a version query parameter is present, without checking whether the corresponding PostRevision is hidden or whether the caller has permission to view edit history. By requesting a post at its publicly known version number via GET /posts/:id.json?version=<public_version>, the next PostRevision's stored modifications are applied unconditionally. If staff have hidden that revision, its pre-edit content is returned to an unauthenticated caller. On patched installs the same request is rejected with 403 because guardian.ensure_can_see!(post_revision) is evaluated first.

Severity

Medium

CVSS Score

5.3

Exploit Probability

1%

Affected Product

discourse

Published Date

September 11, 2026

Template Author

str4k3r

CVE-2026-27454.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-27454
CWE ID:
cwe-862

References

https://github.com/discourse/discourse/security/advisories/GHSA-fq69-f929-wp96https://github.com/discourse/discourse/commit/8510fde30eb0d7f2dee822a95f6cf43b9ac943d0https://nvd.nist.gov/vuln/detail/CVE-2026-27454

Remediation Steps

Upgrade Discourse to 2026.1.2, 2026.2.1, 2026.3.0-latest.1, or later.