CVE-2026-55103

HighCVSS 8.6/10Last modified Oct 16, 2026

Description

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-345 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-551057.7Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, package CVE-2026-551065.3authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce t CVE-2026-5510710.0Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-ge CVE-2026-551088.5KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1 CVE-2026-55112.7In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in l CVE-2026-551106.1A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration CVE-2026-551117.5A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to acces CVE-2026-551128.8A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulner CVE-2026-551137.5A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Applicatio CVE-2026-551148.8A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Networ CVE-2026-551159.9A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Applicat CVE-2026-551169.8A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability