VulnSocial

CVE-2026-44786Patch(discourse / discourse)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch discourse discourse systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

discourse CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
discourse
Products
discourse

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-13: 1Patch / Workaround · 2026-06-13: 1Technical Details · 2026-06-13: 106-13
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    #CVE-2026-44786 - Missing authorization in Discourse exposes chat messages to unauthorized subscribers. #CVSS 7.5. #Update to patched versions now. #Discourse #infosec #cybersecurity #finland #poland More FREE info https://www.valtersit.com/cve/CVE-2026-44786

    Post summary

    Discourse CVE-2026-44786 allows unauthorized subscribers to read chat messages due to missing authorization, with a CVSS score of 7.5. Updated patched versions are now available.

    0000040
    929 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2026.5.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities