Discourse users can purchase a lower‑tier subscription but exploit a flaw in the discourse‑subscriptions plugin to grant themselves the privileges of a higher tier without payment. The vulnerability allows an authenticated user to increase their access level within the application, effectively bypassing the intended tiered access controls. The underlying weakness is a privilege escalation and rights misuse issue.

Installations of the Discourse forum platform that employ the default discourse‑subscriptions plugin and run versions 2026.1.0‑latest up to, but not including, 2026.1.3, 2026.2.0‑latest up to, but not including, 2026.2.2, or 2026.3.0‑latest up to, but not including, 2026.3.0 are affected. All releases from 2026.1.3 onward and from 2026.2.2 onward and from 2026.3.0 onward are not vulnerable.

The medium severity CVSS score of 6.3 reflects the impact of unauthorized privilege escalation. The EPSS score indicates a very low likelihood of exploitation, and the vulnerability is not registered in the CISA KEV catalog. The most likely attack path is a web‑based interaction with the subscription management interface performed by an authenticated user. The flaw is confined to application‑level privileges and does not enable system‑wide access or direct data exfiltration.