Information Disclosure in Discourse Bot Debug Endpoints

Publication date: 2026-06-12

Last updated on: 2026-06-15

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints disclose whisper translation audit logs. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-15

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-01

NVD

CVE-2026-44779

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	From 2026.1.0 (inc) to 2026.1.4 (exc)
discourse	discourse	From 2026.3.0 (inc) to 2026.3.1 (exc)
discourse	discourse	From 2026.4.0 (inc) to 2026.4.1 (exc)
discourse	discourse	2026.1.4
discourse	discourse	2026.3.1
discourse	discourse	2026.4.1
discourse	discourse	2026.5.0-latest.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Discourse open-source discussion platform. In certain versions before specific patches, bot debug endpoints were disclosing whisper translation audit logs. This means that sensitive internal logs related to whisper translations could be accessed through these debug endpoints.

Impact Analysis

The impact of this vulnerability is limited confidentiality exposure. Since the disclosed information is whisper translation audit logs, an attacker with access to these debug endpoints could view potentially sensitive internal data. However, the vulnerability does not affect integrity or availability.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Discourse installation to one of the patched versions: 2026.1.4, 2026.3.1, 2026.4.1, or any version from 2026.5.0-latest.1 onwards.

Hi! I’m here to help you understand CVE-2026-44779. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70