The vulnerability is an authorization bypass in the handling of hidden solved topics. It allows a user who normally does not have permission to accept or unaccept solutions to do so, effectively turning the accepted answer status on or off. This can mislead other users about which answers are considered correct and undermines discussion integrity. The weakness is identified as CWE‑863.

All Discourse installations running a version prior to 2026.3.0‑latest.1, 2026.2.1 or 2026.1.2 are affected. The patch was included in the 2026.3.0‑latest.1 release and back‑ported to the older 2026.2.1 and 2026.1.2 releases. If a site is using a newer build, the vulnerability has been patched; older builds remain exposed until updated.

The CVSS base score of 5.4 indicates a moderate impact. EPSS is below 1 %, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a user account with normal privileges able to see hidden solved topics, a condition that can be met by any user who can log in to the forum. Once the condition is satisfied, the attacker can toggle solution acceptance, thereby manipulating the perceived resolution status of posts. No network‑level exploit is required; the weakness is purely an authorization flaw within the application.