CVE-2026-29072
Unauthorized Policy Widget Creation in Discourse via Permission Bypass
Publication date: 2026-03-19
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Discourse open-source discussion platform. Before certain fixed versions (2026.3.0-latest.1, 2026.2.1, and 2026.1.2), users who were not part of the allowed policy creation groups could still create functional policy acceptance widgets in posts if certain conditions were met. This means unauthorized users could manipulate or create policy acceptance elements within the platform.
The issue is addressed in the specified patched versions, and as a temporary workaround, administrators can disable the discourse-policy plugin by turning off the `policy_enabled` site setting.
How can this vulnerability impact me? :
This vulnerability could allow unauthorized users to create policy acceptance widgets, potentially misleading other users or bypassing intended policy controls within the Discourse platform.
Such unauthorized creation of policy acceptance elements might lead to incorrect acceptance of policies or terms, which could undermine the integrity of policy enforcement and user consent mechanisms.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you should disable the discourse-policy plugin by disabling the `policy_enabled` site setting.
Alternatively, upgrade your Discourse installation to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.