A vulnerability was found in Discourse up to 2025.12.1/2026.1.0. It has been declared as problematic. Affected by this issue is the function
publish_to_category. Such manipulation leads to incorrect authorization.
This vulnerability is traded as CVE-2026-28227. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
