CVE-2026-44783: Discourse: Replying to a whisper lets non-whisperers create staff-only whisper posts
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispersallowedgroups to post into a topic's staff-only whisper channel. The injected content is visible to whisperers (typically staff) alongside legitimate whispers. Only sites that have whispers enabled are affected. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1 - Configuration
If whispers are not required on your site, disable the whispers feature to avoid exposure; only sites with whispers enabled are affected by this issue.
Discourse whispers_enabled = false - Configuration
Review and tighten the whispers_allowed_groups configuration so it contains only the intended staff groups allowed to create and reply to whispers; remove any unintended groups.
Discourse whispers_allowed_groups = restrict to intended staff groups
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44783?
The severity of CVE-2026-44783 is rated as medium with a score of 5.4.
How do I fix CVE-2026-44783?
To fix CVE-2026-44783, upgrade Discourse to version 2026.1.4, 2026.3.1, or 2026.4.1 or later.
What impact does CVE-2026-44783 have on Discourse users?
CVE-2026-44783 allows authenticated users outside of designated whisper groups to access and create staff-only whisper posts.
Which versions of Discourse are affected by CVE-2026-44783?
CVE-2026-44783 affects Discourse versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1.
Is CVE-2026-44783 an easily exploitable vulnerability?
CVE-2026-44783 can be exploited by authenticated users, given the proper conditions, making it a moderate risk.