Discourse ActivityPub: Missing actor authorization on federated posts
Summary
The Discourse ActivityPub plugin does not sufficiently verify that the actor authenticated by an inbound signed request matches the Activity actor and owns the referenced federated post. A remote attacker can use this to edit, delete or reply to federated posts without the required permissions. No privileges or user interaction are required, but the attack only applies to forums with the plugin installed and federation enabled.
Affected
- discourse-activity-pub builds prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5
- Exact affected version range: Unknown (upstream release or tag containing the fix not identified)
Fixed in
- Fixed in commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5
- Fixed version number: Unknown
Workaround
- None documented.
- If the plugin is not required, disable ActivityPub federation until the fixed commit is deployed.
Exploitation
- Automatable: yes (CISA SSVC)
- Public proof-of-concept exploit: none confirmed at time of writing
- Known in-the-wild exploitation: none found
- CISA KEV listing: not verified
Our recommendation
- Check whether the discourse-activity-pub plugin is installed and federation is enabled.
- If it is not needed, disable federation.
- Otherwise update to the upstream code containing commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 and verify the commit is in your build. Do not rely on community forks without verification.
- Review federated posts for unexpected edits, deletions or replies.
- Also review the commit for the outbound SSRF hardening mentioned in the advisory title.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 1c8518b0 (fix) github.com
- GitHub Security Advisory GHSA-jw39-rch6-mhwf github.com
- OSV: CVE-2026-55103 osv.dev
- Vulners NVD: CVE-2026-55103 vulners.com
- Discourse ActivityPub plugin (Meta) meta.discourse.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:06.
Original description (NVD)
Discourse ActivityPub adds ActivityPub support to Discourse. Prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5, inbound ActivityPub processing does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. A remote attacker can exploit these missing identity and ownership checks to edit, delete, or reply to federated posts without the required permissions. This vulnerability is fixed with commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.