A missing authorization vulnerability in Discourse subscription endpoints allows authenticated attackers to modify subscriptions, posing a significant risk to data integrity.

This is a missing authorization vulnerability (CWE-862) occurring within specific subscription-related API endpoints. An authenticated user can leverage this flaw to modify or interact with subscription data belonging to other users due to a lack of proper ownership validation.

The ability for unauthorized users to manipulate subscription settings carries a high risk of service disruption and financial impact. With a CVSS score of 7.1, this vulnerability is classified as High severity, as it facilitates unauthorized access to sensitive account configurations and potentially exposes user billing or service data to malicious actors.

Immediate Action: Update the Discourse installation to versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 immediately to apply the necessary authorization checks.

Proactive Monitoring: Review application access logs for anomalous API requests directed toward subscription endpoints, specifically looking for users attempting to access records outside of their own account scope.

Compensating Controls: Deploy Web Application Firewall (WAF) rules to inspect and filter suspicious traffic directed at subscription management endpoints, though this should be considered a temporary measure until patching is complete.

Public Exploit Available: Unknown

Given the potential for unauthorized modification of subscription data, administrators should prioritize this update within their standard maintenance cycle. Prompt installation of the provided patches is the only effective way to remediate this authorization flaw and prevent potential exploitation of user accounts.