High · published January 28, 2026
⚡ A sneaky flaw could let anyone change subscription details without permission! 🎭 Think of it like a restaurant where anyone at the next table can alter your order without checking with you first. They could change your meal or dessert to something completely different, and there’s no one stopping them from doing so! An attacker could exploit this vulnerability to alter subscription settings, potentially hijacking accounts or changing payment information without the rightful owner's consent. This could lead to unauthorized access, loss of sensitive information, or even financial consequences for users.
Think of it like a restaurant where anyone at the next table can alter your order without checking with you first. They could change your meal or dessert to something completely different, and there’s no one stopping them from doing so! This weakness in Discourse allows unauthorized modifications to subscription endpoints, as there is inadequate ownership verification before performing changes. Essentially, the system fails to confirm who actually owns the subscription before allowing updates.
An attacker could exploit this vulnerability to alter subscription settings, potentially hijacking accounts or changing payment information without the rightful owner's consent. This could lead to unauthorized access, loss of sensitive information, or even financial consequences for users. Update your Discourse platform to versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 immediately to patch this vulnerability. Since there are no known workarounds, ensuring you’re on a secure version is crucial for protecting user data. You've got this! With these updates, you'll keep your community safe and sound! 🛡️