The discourse-policy plugin permitted any authenticated user to load posts by ID and perform policy actions without checking the caller’s visibility rights. This allowed users to accept or unaccept policies on posts in private categories or private messages that they could not normally view, and also enabled enumeration of which post IDs have policies attached through differing error messages. The result was exposure of policy state and the ability to enumerate post IDs with policies attached. Since the flaw centers on lack of authorization, the impact is limited to coordinated enforcement of policies and the leakage of sensitive post identifiers, rather than full code execution or arbitrary data exfiltration.

Affected systems are installations of the open‑source Discourse discussion platform running any version prior to 2025.12.2, 2026.1.1, or 2026.2.0 that have the discourse‑policy plugin enabled. The affected vendor and product are Discourse Discussion Platform, specifically the discourse-policy plugin module.

Risk and exploitability is moderate: the CVSS base score of 5.4 indicates average impact, while the EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access to the forum, and an attacker can perform the unauthorized policy actions by simply issuing the normal API calls that the plugin uses. Since the flaw involves a missing access check, an attacker does not need additional privilege escalation beyond a user account.