Discourse implements topic‑level privacy controls that should prevent users who are no longer members of a private category from interacting with polls embedded in those topics. In the affected releases the check was insufficient, allowing such users to vote or toggle the open/closed state of polls, even though no poll contents were revealed. The flaw is an authorization weakness (CWE‑285) that lets an attacker tamper with poll outcomes without additional privileges.

The issue impacts Discourse releases beginning with 2026.1.0 and continuing through 2026.1.2, then releases starting with 2026.2.0 up to 2026.2.1, and the 2026.3.0 release before the patch. The vulnerability is fixed in releases 2026.1.3, 2026.2.2, 2026.3.0 and newer.

The CVSS score of 6.3 indicates medium severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of exploitation in the wild is uncertain. An attacker would need a valid authenticated session and must have previously had access to the private category; once removed, the user could still exploit poll endpoints to alter results.