CVE-2026-91156

Deferred Deferred - Pending Action

Information Disclosure in Discourse via MessageBus

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91156

EUVD

EUVD-2026-101300

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	< 2026.1.9
discourse	discourse	>= 2026.7.0-latest, < 2026.7.3
discourse	discourse	>= 2026.8.0-latest, < 2026.8.1
discourse	discourse	>= 2026.9.0-latest, < 2026.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse allows unauthorized users to receive live and recent messages from restricted category chat channels through MessageBus backlogs. It occurs because MessageBus events for category chats were not properly restricted to eligible users, even if those users could view the category but lacked Chat access permissions.

Detection Guidance

To detect this vulnerability, check if your Discourse instance is running a vulnerable version (before 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9). Verify if restricted category chat messages are accessible to unauthorized users by inspecting MessageBus event handling and group permissions. Review logs for unauthorized message deliveries in restricted category channels.

Impact Analysis

Unauthorized users could access sensitive chat messages in restricted categories, leading to information leakage. However, full channel history is not exposed, and users cannot create or modify messages. Attackers could exploit this to view confidential discussions.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data to unauthorized users, potentially breaching confidentiality obligations under GDPR, HIPAA, or other regulations. Organizations must ensure proper access controls to maintain compliance.

Mitigation Strategies

Upgrade Discourse to versions 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 or later to patch the vulnerability.
Remove unauthorized users from restricted categories to prevent access to sensitive chat messages.
Avoid using affected read-restricted categories with users who are disallowed from using Chat.

Hi! I’m here to help you understand CVE-2026-91156. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70