CVE-2026-44786

Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in Discourse Chat Events

Publication date: 2026-06-12

Last updated on: 2026-06-15

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-12

Last Modified

2026-06-15

Generated

2026-07-03

AI Q&A

2026-06-13

EPSS Evaluated

2026-07-01

NVD

CVE-2026-44786

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	From 2026.1.0 (inc) to 2026.1.4 (exc)
discourse	discourse	From 2026.3.0 (inc) to 2026.3.1 (exc)
discourse	discourse	From 2026.4.0 (inc) to 2026.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Discourse open-source discussion platform in certain versions before they were patched. Specifically, chat events for public category channels were published to the MessageBus system without proper permission checks. As a result, any subscriber to the MessageBus, even those without chat enabled, could receive chat message payloads in real time.

Impact Analysis

The impact of this vulnerability is that unauthorized users or systems subscribing to the MessageBus could receive chat messages from public category channels without permission. This could lead to unintended disclosure of chat content, potentially exposing sensitive or private discussions to unauthorized parties.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Discourse installation to one of the patched versions: 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1.

Compliance Impact

This vulnerability allows chat events for public category channels to be published to MessageBus without permission scoping, meaning any subscriber could receive chat message payloads in real time without proper authorization.

Such unauthorized disclosure of chat message payloads could potentially lead to violations of data protection regulations like GDPR or HIPAA, which require strict controls over access to personal and sensitive information.

However, the provided information does not explicitly state the impact on compliance with these standards.

Hi! I’m here to help you understand CVE-2026-44786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70