‹ Back to list

CVE-2026-55103

Status: DeferredHigh (8.6)—
Severity8.6High · CVSS 3.1
Exploitation probability0.20 %higher than 9% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.

CVSS

Base score
8.6
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.20 %
Percentile among all scored CVEs
9
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector AV:N/PR:N/UI:N y el texto indica que un atacante remoto edita, borra o responde posts federados sin permisos por falta de verificación de identidad y propiedad. La pista de T1078 y T1195.002 no encaja.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningUser Account ManagementRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Discourse — Discourse ActivitypubAI

CWEs

References

Show 2 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-55103",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse-activity-pub",
          "versions": [
            {
              "status": "affected",
              "version": "< 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-15T18:17:27.163",
  "references": [
    {
      "url": "https://github.com/discourse/discourse-activity-pub/commit/1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse-activity-pub/security/advisories/GHSA-jw39-rch6-mhwf",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5."
    }
  ],
  "lastModified": "2026-10-16T20:04:29.760",
  "sourceIdentifier": "security-advisories@github.com"
}