The vulnerability exists in the poll plugin of an open source discussion platform. A missing check on the voters endpoint allows an attacker who can reach the endpoint to retrieve the list of users who voted on any poll, regardless of the post’s visibility restrictions. This results in a breach of confidentiality, providing personal voting data that should be protected by post-level permissions, potentially exposing user preferences and activity patterns.

Discourse installations running any version prior to 2025.12.2, 2026.1.1, or 2026.2.0 are impacted. The affected product is the Discourse forum software with its poll plugin.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to be able to send requests to the voters endpoint, which is typically available to any user with network connectivity to the forum. No exploitation conditions are explicitly stated, so the vulnerability can be abused by unauthenticated or low-privilege users if they can reach the URL.