CVE-2026-55103
Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.
| CWE | CWE-345 CWE-863 |
| Vendor | discourse |
| Product | discourse-activity-pub |
| Published | Oct 15, 2026 |
| Last Updated | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for discourse discourse-activity-pub
Be the first to know when new high vulnerabilities affecting discourse discourse-activity-pub are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
discourse / discourse-activity-pub
< 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5