CVE-2026-27021 MEDIUM

CVE-2026-27021: Discourse: Poll voters endpoint lacked post visibility checks

Vendor Discourse
Product discourse
Weakness CWE-862 · Missing authorization
Published February 26, 2026
Last update February 28, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
February 28, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-45101 WordPress Customer Reviews for WooCommerce plugin <= 5.36.0 - Broken Access Control vulnerability CVE-2026-3266 Improper access control vulnerability has been discovered in OpenText™ Filr. CVE-2025-39522 WordPress Dynamic Post plugin <= 5.03 - Settings Change vulnerability CVE-2025-15041 BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update CVE-2025-59581 WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability