The vulnerability allows a user who has lost access to a topic to still interact with polls within that topic, including voting and toggling the poll status. This creates an access control bypass that can be used to manipulate poll outcomes without exposing content. The impact is therefore a privilege escalation that enables malicious users to influence poll results, potentially disrupting community moderation or decision-making processes.

Discourse platform versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 prior to the 2026.3.0 release are affected. The issue was addressed in the 2026.1.3, 2026.2.2, and 2026.3.0 patches.

The CVSS score of 6.3 indicates a moderate severity. EPSS shows an exploitation probability of less than 1%, and the flaw is not listed in the CISA KEV catalog. An attacker can exploit this by authenticating to the site and using normal poll endpoints, so the vector is likely remote and web‑based. Given the low probability of exploitation and lack of a publicly available exploit, the risk is moderate, but the impact of poll manipulation can be significant for community trust and decision integrity.