CVE-2026-44782: Discourse: GroupPostSerializer leaks hidden full names through reaction post association
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared includeuserlongname? as the predicate for its :name attribute, but AMS looks for includename?. The misnamed predicate was never called, so object.user.name was always serialized regardless of SiteSetting.enablenames. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44782?
The severity of CVE-2026-44782 is medium with a CVSS score of 4.3.
How do I fix CVE-2026-44782?
You can fix CVE-2026-44782 by updating Discourse to the latest version, specifically to 2026.1.4, 2026.3.1, or 2026.4.1 or later.
What type of vulnerability is CVE-2026-44782?
CVE-2026-44782 is classified as an information leak vulnerability.
What systems are affected by CVE-2026-44782?
CVE-2026-44782 affects Discourse versions between 2026.1.0 and before 2026.1.4, 2026.3.0 and before 2026.3.1, and 2026.4.0 and before 2026.4.1.
What specific issue does CVE-2026-44782 address?
CVE-2026-44782 addresses the GroupPostSerializer leaking hidden full names through reaction post association.