A role‑based access control flaw in Discourse allows users with category group moderator privileges to perform privileged actions on topics within private categories that they are not permitted to read. The vulnerability can enable moderation or destructive actions on content hidden from other users, potentially leading to unauthorized data manipulation or disclosure.

Discourse instances running any of the following versions are affected: 2026.1.0 up to but not including 2026.1.3, 2026.2.0 up to but not including 2026.2.2, and 2026.3.0 up to but not including 2026.3.0. The issue has been patched in the corresponding 2026.1.3, 2026.2.2, and 2026.3.0 releases.

The CVSS score of 5.3 indicates a medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a legitimate moderator of a category group, suggesting that an attacker with such credentials could exploit the flaw over the web interface. No evidence indicates that the flaw allows remote code execution or unauthenticated access; it appears to be confined to authorized moderator accounts.