Discourse contains an IDOR flaw in the ReviewableNotesController that enables users belonging to a category moderation group to create or delete reviewable notes on any reviewable in the system, even if the reviewable resides in a category they do not moderate. The controller performed an unscoped lookup and only verified general access to the review queue, not access to the specific reviewable. This breach of access control is reflected by the CWE identifiers for Broken Access Control and Privilege Escalation.

The vulnerability affects the open source forum platform Discourse. All releases prior to version 2025.12.2, 2026.1.1, and 2026.2.0 are impacted when the "enable_category_group_moderation" site setting is enabled. Staff users (admins and moderators) are not affected because they already possess full access to reviewables.

With a CVSS score of 4.3 the vulnerability is considered moderate severity. The EPSS score is below 1% indicating a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Attackers must be authenticated users who belong to a category moderation group and must have the site setting enabled. The exploit path involves issuing a request to the ReviewableNotesController to create or delete a note on any reviewable, thereby bypassing intended permission checks.