CVE-2026-44786: Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44786?
The severity of CVE-2026-44786 is high with a CVSS score of 7.5.
How do I fix CVE-2026-44786?
To fix CVE-2026-44786, upgrade Discourse to version 2026.1.4 or later, or to version 2026.3.1 or later.
What type of vulnerability is CVE-2026-44786?
CVE-2026-44786 is classified as an information leak vulnerability.
Which Discourse versions are affected by CVE-2026-44786?
CVE-2026-44786 affects Discourse versions from 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1.
What is the impact of CVE-2026-44786?
The impact of CVE-2026-44786 allows unauthorized users to access public chat events improperly published to the MessageBus.