CVE-2026-27021 — Discourse: Poll voters endpoint lacked post visibility checks

CVE-2026-27021

Discourse: Poll voters endpoint lacked post visibility checks PUBLISHED

Description (CNA)

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Affected (CNA)

Vendor / product	Versions
discourse / discourse	affected < 2025.12.2; affected >= 2026.1.0-latest, < 2026.1.1; affected >= 2026.2.0-latest, < 2026.2.0

CWE

CWE-862

References

https://github.com/discourse/discourse/security/advisories/GHSA-f5m5-9hpw-7c2g

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.