CVE-2026-55103
8.6HighPublished 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-345, CWE-863
Impact
Remote unauthenticated attackers can edit, delete, or reply to federated posts across your forum. They only need network access to send crafted inbound ActivityPub requests to the instance.
Root cause
Inbound ActivityPub request processing fails to verify that the signed request's authenticated actor matches the Activity actor and owns the targeted post.
Affected systems
discourse-activity-pub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 (tagged versions not specified in data).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Fix & remediation
Update the discourse-activity-pub plugin to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 or later. If updating immediately is not possible, disable the ActivityPub plugin in Discourse settings.
$ cd /var/discourse && ./launcher rebuild appAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.