An improper authorization check in the topic management logic of Discourse allows an authenticated user to alter privileged attributes of a topic. By crafting specific parameters in a PUT or POST request, a regular user can promote a topic to a site‑wide notice or banner, effectively bypassing administrative restrictions. This flaw represents a classic privilege escalation scenario, enabling a non‑admin to exercise capabilities reserved for site managers.

Discourse, the open source discussion platform, is affected in all releases prior to 2025.12.2, 2026.1.1, and 2026.2.0. Users running any of these unpatched versions are vulnerable to the mass assignment exploitation described.

The CVSS score of 1.3 indicates a low severity rating, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation at this time. Attackers need only authenticated access; the flaw can be triggered via standard HTTP topic update endpoints, and no additional prerequisites such as privileged network access are required. While the impact is confined to the user’s own topics, the ability to create site‑wide banners can misrepresent official communications or obscure legitimate notices.