CVE-2026-27150CWE-862

Discourse doesn't ensure guardian check when creating QueryGroupBookmark

Low · published February 26, 2026

CVSS v4.0
1.3
EPSS
0%
Percentile
17.5
In the wild
Unconfirmed
What it is

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available.

The record
Technical detail
CVSS v4.0
1.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U
EPSS
0.00266 · 17.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-26T19:55Z
EPSS history
Timeline
  • 26 FEB 19:55Z
    Discourse doesn't ensure guardian check when creating QueryGroupBookmark
    cvelistv5