CVE-2026-27150

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27150", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T00:18:53.961Z", "datePublished": "2026-02-26T19:55:35.263Z", "dateUpdated": "2026-03-03T01:43:29.850Z"}, "containers": {"cna": {"title": "Discourse doesn't ensure guardian check when creating QueryGroupBookmark", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8"}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"version": "< 2025.12.2", "status": "affected"}, {"version": ">= 2026.1.0-latest, < 2026.1.1", "status": "affected"}, {"version": ">= 2026.2.0-latest, < 2026.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T19:55:35.263Z"}, "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available."}], "source": {"advisory": "GHSA-rw95-54qr-qrw8", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T01:43:16.995941Z", "id": "CVE-2026-27150", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T01:43:29.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27150", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-03T01:43:16.995941Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T01:43:23.343Z"}}], "cna": {"title": "Discourse doesn't ensure guardian check when creating QueryGroupBookmark", "source": {"advisory": "GHSA-rw95-54qr-qrw8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "discourse", "product": "discourse", "versions": [{"status": "affected", "version": "< 2025.12.2"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.0"}]}], "references": [{"url": "https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8", "name": "https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T19:55:35.263Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27150", "state": "PUBLISHED", "dateUpdated": "2026-03-03T01:43:29.850Z", "dateReserved": "2026-02-18T00:18:53.961Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T19:55:35.263Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "discourse", "vendor": "discourse", "versions": [{"status": "affected", "version": "< 2025.12.2"}, {"status": "affected", "version": ">= 2026.1.0-latest, < 2026.1.1"}, {"status": "affected", "version": ">= 2026.2.0-latest, < 2026.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "matchCriteriaId": "452E5338-8153-4A3E-B634-CAE43E14B557", "versionEndExcluding": "2025.12.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CAFCC9D-53D7-4017-85A5-EE6CA5A6A11C", "versionEndExcluding": "2026.1.1", "versionStartIncluding": "2026.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:discourse:discourse:2026.2.0:*:*:*:latest:*:*:*", "matchCriteriaId": "BB002FDC-BC71-4C46-8AAF-A34EC717E0E7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Explorer's `QueryGroupBookmarkable` allows any logged-in user to create bookmarks for query groups they don't have access to, enabling metadata disclosure via bookmark reminder notifications. Versions 2025.12.2, 2026.1.1, and 2026.2.0 fix this issue and also make sure `validate_before_create` throws NotImplementedError in BaseBookmarkable if not implemented, to prevent similar issues in the future. No known workarounds are available."}, {"lang": "es", "value": "Discourse es una plataforma de discusi\u00f3n de c\u00f3digo abierto. Antes de las versiones 2025.12.2, 2026.1.1 y 2026.2.0, la falta de autorizaci\u00f3n 'validate_before_create' en 'QueryGroupBookmarkable' de Data Explorer permite a cualquier usuario autenticado crear marcadores para grupos de consultas a los que no tienen acceso, lo que permite la divulgaci\u00f3n de metadatos a trav\u00e9s de notificaciones de recordatorio de marcadores. Las versiones 2025.12.2, 2026.1.1 y 2026.2.0 solucionan este problema y tambi\u00e9n aseguran que 'validate_before_create' arroje un NotImplementedError en BaseBookmarkable si no se implementa, para prevenir problemas similares en el futuro. No se conocen soluciones alternativas disponibles."}], "id": "CVE-2026-27150", "lastModified": "2026-06-17T10:26:45.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27150", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T01:43:16.995941Z", "version": "2.0.3"}}]}, "published": "2026-02-26T21:28:54.343", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/discourse/discourse/security/advisories/GHSA-rw95-54qr-qrw8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2025.12.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.1.0-latest,2026.1.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2026.2.0-latest,2026.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "discourse", "source": "cna", "vendor": "discourse"}, "product": "discourse", "vendor": "discourse"}], "analysis": {"en": {"generated_at": "2026-04-16T16:04:07.205120+00:00", "value": {"mitigation_remediation": ["Upgrade the Discourse application to version 2026.2.0 or higher, which contains the fix.", "Temporarily disable the Data Explorer's QueryGroupBookmarkable functionality or restrict Data Explorer access to trusted roles until the patch is applied.", "Review Discourse logs for unexpected bookmark creation events in query groups and alert site administrators."], "summary": {"action": "Apply Patch", "impact": "Unauthorized Bookmark Creation and Metadata Disclosure"}, "threat_synthesis": {"affected_systems": "The problem exists in the open\u2011source Discourse forum platform. Versions up to, but not including, 2025.12.2, 2026.1.1, and 2026.2.0 are affected. Consequently, any site running Discourse 2025.12.1 or earlier, 2026.1.0 or earlier, or 2026.2.0\u2011beta versions is vulnerable. Upgrading to any of the patched releases fixes the issue. No other vendors or products are listed.", "description_and_impact": "Discourse's Data Explorer feature lacked an authorization check when creating QueryGroupBookmarks. This oversight lets any logged\u2011in user create bookmarks for query groups they do not own or have permission to view. As a result, the system can expose metadata about query group access and composition through bookmark reminder notifications, violating confidentiality. The weakness is a missing authorization guard (CWE\u2011862).", "risk_and_exploitability": "The CVSS is 1.3, indicating a low severity. EPSS is below 1%, meaning that exploitation is currently considered very unlikely. The vulnerability is not listed in the CISA KEV catalogue. Because the flaw requires a logged\u2011in user with access to the Data Explorer interface, an attacker would need either legitimate credentials or an active session. The lack of an authorisation guard lets the user create bookmarks for inaccessible query groups, leaking metadata through reminders. Overall, while the impact is limited to some metadata disclosure, the risk level remains low, and widespread exploitation is not currently reported."}}}}, "created": "2026-02-27T09:07:02.837567+00:00", "updated": "2026-04-16T16:15:08.459507+00:00", "vendors": ["discourse", "discourse$PRODUCT$discourse"]}