PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34154 discourse CVE debrief

CVE-2026-34154 is a low-severity access-control issue in Discourse’s discourse-subscriptions plugin. According to the official advisory and NVD record, affected deployments before 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 could allow users to gain access to subscription-gated groups without completing payment. The flaw is tracked as CWE-862 (improper authorization) and was publicly disclosed on 2026-05-19.

Vendor
discourse
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

Discourse administrators and maintainers who use the discourse-subscriptions plugin or run paid, subscription-gated communities should review this immediately, especially if their instance is on any version earlier than the fixed releases.

Technical summary

The vulnerability affects the discourse-subscriptions plugin and involves insufficient authorization checks around access to subscription-gated groups. The official data identifies CWE-862 and indicates a network-reachable issue that requires user interaction, with low confidentiality impact and no integrity or availability impact recorded in the supplied CVSS vector. Fixed versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Defensive priority

Low overall severity, but prioritize patching if your Discourse instance depends on paid membership or subscription enforcement. Unauthorized access to gated groups can directly affect access control and revenue assumptions even when the CVSS score is low.

Recommended defensive actions

  • Upgrade Discourse to a fixed release: 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1, depending on your release track.
  • Review any subscription-gated groups for unintended membership or access anomalies since the issue may have allowed access without completed payment.
  • Validate that the discourse-subscriptions plugin is updated alongside the core Discourse release path you use.
  • Monitor the official GitHub Security Advisory and NVD record for any follow-up guidance or revisions.

Evidence notes

This debrief is based only on the supplied NVD record and the linked official GitHub Security Advisory (GHSA-pjgj-7mjq-6j7g). The source data states the issue affects versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1, and that the weakness is CWE-862. NVD lists the vulnerability status as "Awaiting Analysis" in the provided record, and the supplied CVSS v4 vector shows AV:N/AC:H/AT:P/PR:N/UI:A with low confidentiality impact only.

Official resources

Publicly disclosed on 2026-05-19 via the linked GitHub Security Advisory and reflected in the NVD record the same day.