CVE-2026-26973

Summary: CVE-2026-26973 affects Discourse before versions 2025.12.2, 2026.1.1, and 2026.2.0, where an IDOR in the ReviewableNotesController allows a user in a category moderation group to create or delete notes on any reviewable when enable_category_group_moderation is on. Root cause: unscoped Re...

CVE-2026-26973 Discourse doesn't scope reviewable notes to user-visible reviewables

Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR Insecure Direct Object Reference in ReviewableNotesController. When enablecategorygroupmoderation is enabled, a user belonging to a category moderation group can create or delete thei...