CVE-2026-55103
Received Received - Intake

ActivityPub Identity Spoofing in Discourse

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55103
EUVD
EUVD-2026-102202

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
discourse discourse-activity-pub < 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Discourse ActivityPub plugin allows remote attackers to edit, delete, or reply to federated posts without proper permissions. It occurs because inbound ActivityPub requests do not verify if the authenticated actor matches the activity actor or owns the referenced post. The issue was fixed by adding stricter identity verification checks in commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

Impact Analysis

An attacker could exploit this to modify or delete your federated posts without authorization. They could also reply to posts as if they were you, potentially spreading misinformation or causing reputational harm. The vulnerability requires no privileges or user interaction to exploit.

Mitigation Strategies

Update the Discourse ActivityPub plugin to the latest version that includes commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 to enforce stricter actor identity verification.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55103. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart