Discourse Subscriptions Plugin: Unauthorized Access w/o Payment (2026.1.4)
CVE-2026-34154 Published on May 19, 2026
Discourse has a subscription access bypass in its discourse-subscriptions plugin
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability in the discourse-subscriptions plugin allows users to gain access to subscription-gated groups without completing payment. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.
Vulnerability Analysis
CVE-2026-34154 is exploitable with network access. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-34154 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-34154
Want to know whenever a new CVE is published for Discourse? stack.watch will email you.
Affected Versions
discourse:- Version < 2026.1.4 is affected.
- Version >= 2026.3.0-latest, < 2026.3.1 is affected.
- Version >= 2026.4.0-latest, < 2026.4.1 is affected.
- Version >= 2026.5.0-latest, < 2026.5.0-latest.1 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.