Discourse TL4 Priv Escalation: Close/Pin in private categories (pre v2025.12.2)
CVE-2026-26979 Published on February 26, 2026
Discourse: TL4 users are able to change status of restricted topics
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in private categories they don't have access to. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-26979 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-26979
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2025.12.2 is affected.
- Version >= 2026.1.0-latest, < 2026.1.1 is affected.
- Version >= 2026.2.0-latest, < 2026.2.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.