Discourse has a subscription access bypass in the discourse‑subscriptions plugin that allows unauthenticated or non‑paying users to join groups that are gated by a paid subscription. The primary impact is unauthorized access to premium discussion content, exposing potentially sensitive or proprietary information to users who have not completed payment. This is a classic Missing Authorization weakness (CWE‑862).

All installations of Discourse running the discourse‑subscriptions plugin with versions older than 2026.1.4, 2026.3.1, 2026.4.1 or 2026.5.0‑latest.1 are affected. The vulnerability is present in the plugin code that checks membership status before granting group access. The issue was fixed in the listed patch releases, so any deployment that has not yet been upgraded remains vulnerable.

The CVSS score of 2.1 indicates low severity, and the EPSS score is not available, which suggests the exploit probability is currently unclear but not known to be high. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood that a widespread exploit exists. The likely attack vector is remote through the web interface, where a user can request to join a subscription group and the system mistakenly allows access without verifying payment status.