Discourse, an open source discussion platform, contains a flaw that allows any user with Teaching Lead (TL4) authority to create new topics in staff-only categories using the publish_to_category function of a topic timer. The vulnerability stems from missing authorization checks, giving privileged users unauthorized content insertion capability and effectively elevating their privileges within restricted categories. This flaw is classified as CWE‑863, indicating a missing authorization check.

Discourse participants running any version prior to 2025.12.2, 2026.1.1, or 2026.2.0 are affected. The issue applies to the Discourse application itself, and the specific CPE strings identify all versions of the software found in the vulnerability list. All other versions released after those patches are considered fixed.

With a CVSS score of 1.2, attackers face only minimal consequences, and the EPSS score of less than 1% indicates a low probability of exploitation. No known exploit activity exists, and the vulnerability is not included in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector requires an authenticated TL4 user and does not assume a remote execution method. In absence of a public exploit, the risk is limited to potential misuse by legitimate staff members with TL4 rights who can trigger topic timers to publish content where they should not.