A type coercion bug in Discourse’s post‑actions API allows a logged‑in user who is not staff to craft a request that creates a warning against another user. Because warnings are intended for moderation staff, this flaw gives non‑staff members a limited moderation privilege, potentially affecting user reputation and platform trust. The vulnerability does not reveal data or provide full privilege escalation beyond warning creation.

The issue affects all Discourse releases earlier than 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2, in which non‑staff users can trigger the warning endpoint. The flaw is limited to authenticated users; unauthenticated visitors cannot initiate the attack. The affected product is the open‑source Discourse discussion platform.

The CVSS score of 6.9 indicates a medium severity risk. EPSS shows an exploitation likelihood below 1 % and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Based on the description, the attack vector is remote via the API and requires an authenticated user to send a crafted request, meaning that a legitimate user with an account can abuse the warning system, though no additional system resources are impacted.