Is CVE-2026-26207 actively exploited?

No active exploitation of CVE-2026-26207 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26207 be exploited remotely?

Yes. CVE-2026-26207 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26207?

CVE-2026-26207 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2026-26207

MEDIUM

CVE-2026-26207

CWE-862Published: February 26, 2026· Updated: Mar 2, 2026

5.4

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.6th

Official Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private categories or PMs they cannot see and any authenticated user to enumerate which post IDs have policies attached via differentiated error responses (information disclosure). The issue is patched in versions 2025.12.2, 2026.1.1, and 2026.2.0 by adding a `guardian.can_see?(@post)` check in the `set_post` before_action, ensuring post visibility is verified before any policy action is processed. As a workaround, disabling the discourse-policy plugin (`policy_enabled = false`) eliminates the vulnerability. There is no other workaround without upgrading.

NVD Source

Technical Analysis

CVE-2026-26207 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.