Improper access control in Discourse - CVE-2026-29072
Published: July 1, 2026
Vulnerability identifier: #VU136163
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-29072
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Civilized Discourse Construction Kit, Inc.
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote user to create functional policy acceptance widgets in posts.
The vulnerability exists due to improper access control in the discourse-policy plugin when creating policy widgets in posts. A remote user can create a policy acceptance widget to create functional policy acceptance widgets in posts.
Only users who do not belong to the allowed policy creation groups are able to exploit this issue under the right conditions.
How to mitigate CVE-2026-29072
Install security update from vendor's website.