Technical impact
Discourse users with a trust level of 4 are able to close, archive, and pin topics that are in private categories to which the users do not have normal access. The flaw allows the user to alter the state of restricted content, effectively bypassing the intended access controls. This privilege escalation can lead to unwanted visibility changes, potential removal of discussion, or concealment of content, compromising the integrity of private discussions. The weakness aligns with CWE-862: Missing Authorization
Affected Systems
Discourse platforms running any version prior to 2025.12.2, 2026.1.1, or 2026.2.0 are affected. Those older builds expose the privilege escalation to TL4 users.
Risk and Exploitability
The CVSS score of 2.7 indicates a low severity, and the EPSS score is under 1%, meaning exploitation is unlikely in the short term. The vulnerability is not listed in the CISA KEV catalog, and no workarounds exist. Attackers can exploit this only by having a legitimate TL4 role; the ability to change topic status in private categories directly follows from that role. Because no additional conditions are required, the feature can be abused by any TL4 user as soon as the system is in an affected state.
