Discourse versions prior to 2026.1.4, 2026.3.1, and 2026.4.1 contain a vulnerability in the discourse-subscriptions plugin that allows users to bypass subscription payment requirements and gain access to subscription-gated groups. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0. The severity of this vulnerability is considered low.