CVE-2026-55103High· 8.6▾ TwilightDiscourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91157High· 7.5Discourse is an open-source discussion platform
CVE-2026-56832High· 8.8PraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
CVE-2026-32597High· 7.5PyJWT is a JSON Web Token implementation in Python
CVE-2017-20290Medium· 6.1Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
CVE-2026-57447Medium· 4.3Discourse Doc Categories is a plugin for organizing Discourse topics as documentation
CVE-2026-91159High· 7.7Discourse is an open-source discussion platform