CVE-2026-27150 LOW

CVE-2026-27150: Discourse doesn't ensure guardian check when creating QueryGroupBookmark

Vendor Discourse
Product discourse
Weakness CWE-862 · Missing authorization
Published February 26, 2026
Last update March 3, 2026
View on NVD All CVEs

CVSS base score

1.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

What the vulnerability does

01Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
March 3, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-42986 Missing Authorization check in SAP NetWeaver and ABAP Platform CVE-2026-1930 Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion CVE-2026-4484 Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVE-2023-34019 WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerability