CVE-2026-27021
Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibility checks which allowed unauthorized access to voters details of polls in any post. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.
- Affected products
- Discourse
- Discourse
- < 2025.12.0, 2026.1.1, 2026.2.0
- Fix
- Available
- CVSS 4.0
- 6.9 MEDIUM
- CVSS 3.1
- 5.3 MEDIUM
- EPSS
- 0.3% (20th percentile)
- Weakness
- CWE-862
- NVD status
- Analyzed
- Published
- 2026-02-26
CVE-2026-27021 at NVD
No indexed exploits for CVE-2026-27021 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-27021 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.