VulnSocial

CVE-2026-45788Disclosure(discourse / discourse)

LOWCVSS 7.5 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch discourse discourse systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

discourse CVEsBack to dashboard
2.0/ 10 priority

Sources & remediation

Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • discourse

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 2d ago at 2 mentions (2026-07-10); latest day: 1
  • 4 total mentions across 3 days

Affected systems

Vendors
discourse
Products
discourse

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-07-10: 2Mentions · 2026-07-15: 1Mentions · 2026-09-18: 1PoC Mentioned / Linked · 2026-09-18: 1Patch / Workaround · 2026-07-10: 1Technical Details · 2026-07-10: 2Technical Details · 2026-07-15: 1Technical Details · 2026-09-18: 107-1007-1509-18
Signal classification2 categories
Disclosure
375.0%
PoC
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-07-102
Disclosure2
2026-07-151
Disclosure1
2026-09-181
PoC1
Full discourse4 posts
  • 极智科研@findchain
    PoC

    安全公司 Hacktron AI 的白帽黑客用 Anthropic 的 Claude 找到了 Discourse 的一个漏洞（CVE-2026-45788），顺着它拿到了 OpenAI 员工的 ChatGPT 账户 token，从而有限读取了 OpenAI 私有仓库 Monorepo 里的文档和元数据，还提了个拉取请求当证据。OpenAI 随后付了 6500 美元赏金。 有意思的点不在金额，而在于攻击链的起点：漏洞出在 Discourse 这种外围论坛组件上，最后却通到了内部代码仓库。很多团队的边界防护都盯着核心系统，反而容易忽略这类看起来无关紧要的第三方服务。另外这次是 Claude 帮忙找的洞，AI 参与漏洞挖掘正在变成常规操作。 https://www.ithome.com/1/004/068.htm #AI

    Post summary

    A white hat researcher used AI to discover CVE-2026-45788 in Discourse, gaining access to OpenAI's internal repository and offering a bounty, demonstrating a working proof of concept.

    0000079
    23 followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Discourse, Information Disclosure, #CVE-2026-45788 (High) -DC-Jul2026-983 https://dailycve.com/discourse-information-disclosure-cve-2026-45788-high-dc-jul2026-983/

    Post summary

    The post announces a newly disclosed high‑severity information‑disclosure vulnerability, CVE-2026-45788, on a dailyCVE bulletin with no evidence of PoC, exploitation, or patch availability.

    0000032
    219 followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-45788 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an… https://www.cve.org/CVERecord?id=CVE-2026-45788 ----- Traducción: CVE-2026-45788 Dis… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑45788 for Discourse, warning that secure uploads can be exposed via pull_hotlinked_images in certain older versions, but it provides no PoC, exploit code, or patch details.

    0000050
    91 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-45788 Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an… https://www.cve.org/CVERecord?id=CVE-2026-45788

    Post summary

    The advisory notes that prior Discourse releases are vulnerable to secure upload exposure via pull_hotlinked_images, and that newer releases contain a patch.

    00000457
    57.8K followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Appdiscoursediscourse---
Appdiscoursediscourse2026.6.0--

Explore more

Back to dashboarddiscourse CVEsdiscourse vulnerabilities