A flaw allows staff members to change the notification level for any user. This escalates staff privileges to modify user preferences that normally require the user’s consent, violating the principle of least privilege (CWE‑862). The alteration can cause users to miss important updates or be flooded with notifications, degrading the platform’s reliability and usability. Although the change affects only notification behavior, it represents a measurable integrity breach of user settings.

The vulnerability exists in the Discourse discussion platform, specifically in versions prior to 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2. The affected product is Discourse by Discourse Inc. Subsequent releases beginning with 2026.3.0‑latest.1, 2026.2.1, and 2026.1.2 contain a patch that removes the ability for staff to modify arbitrary user notification levels.

The CVSS score of 1.3 indicates a low severity risk. The EPSS score is below 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires staff-level access; thus, the attack surface is limited to authenticated insiders or compromised staff credentials. Because the flaw does not allow arbitrary code execution or data exfiltration, the overall threat is low but still warrants immediate patching once a suitable update is available.