Is CVE-2026-27454 actively exploited?

No active exploitation of CVE-2026-27454 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-27454 be exploited remotely?

Yes. CVE-2026-27454 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-27454?

CVE-2026-27454 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-27454

MEDIUM

CVE-2026-27454

CWE-862Published: March 19, 2026· Updated: Mar 25, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:8.2th

Official Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed authorization checks on post revisions. The display_post method called post.revert_to directly without verifying whether the revision was hidden or if the user had permission to view edit history. This meant hidden revisions (intentionally concealed by staff) could be read by any user by simply enumerating version numbers. Starting in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, Discourse looks up the PostRevision and call guardian.ensure_can_see! before reverting, consistent with how the /posts/:id/revisions/:revision endpoint already authorizes access. No known workarounds are available.

NVD Source

Technical Analysis

CVE-2026-27454 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.