CVE-2026-55103: CWE-345: Insufficient Verification of Data Authenticity in discourse discourse-activity-pub

Discourse ActivityPub prior to commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5 does not sufficiently verify that the actor authenticated by the signed request matches the Activity actor and owns the referenced federated post. This insufficient verification allows a remote attacker to perform unauthorized actions such as editing, deleting, or replying to federated posts without the required permissions. The vulnerability is identified as CWE-345 (Insufficient Verification of Data Authenticity) and CWE-863 (Incorrect Authorization). The issue is fixed by the specified commit which properly enforces identity and ownership checks.

A remote attacker can exploit this vulnerability to modify or delete federated posts or reply to them without authorization, potentially compromising the integrity of federated content within Discourse instances using the discourse-activity-pub plugin. The vulnerability does not affect confidentiality or availability but impacts integrity with a high severity rating.

This vulnerability is fixed in commit 1c8518b0f2abdf31cbea3e0b242f74d8994a9ba5. Users of discourse-activity-pub should update to a version that includes this commit to ensure proper verification of actor identity and ownership. No other mitigation guidance is provided or necessary as the fix addresses the root cause.