CVE-2026-44785: Discourse: Hidden reply-to post raw can be disclosed through AI explain prompts
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks cansee? on the post being explained, not its replytopost, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking "Explain" on a reply to it. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44785?
The severity of CVE-2026-44785 is rated as medium with a score of 4.3.
What does CVE-2026-44785 refer to?
CVE-2026-44785 refers to a vulnerability in Discourse where hidden reply-to post raw content can be disclosed through AI explain prompts.
How do I fix CVE-2026-44785?
To fix CVE-2026-44785, upgrade to Discourse version 2026.1.4 or 2026.3.1 or 2026.4.1 or later.
Who is affected by CVE-2026-44785?
Authenticated users of Discourse versions prior to the specified patches are affected by CVE-2026-44785.
What type of vulnerability is CVE-2026-44785?
CVE-2026-44785 is classified as an information leakage vulnerability.