CVE-2026-44787: Discourse: Signup-time primary_group_id assignment grants whisperer access
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primarygroupid and gain whisper-group privileges without legitimate group membership on sites with whispersallowedgroups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44787?
The severity of CVE-2026-44787 is rated high with a CVSS score of 8.2.
How do I fix CVE-2026-44787?
To fix CVE-2026-44787, upgrade to Discourse versions 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.
What impact does CVE-2026-44787 have on my Discourse instance?
CVE-2026-44787 allows newly registered users to gain unauthorized whisper-group privileges due to improper primary_group_id assignment.
When was CVE-2026-44787 published?
CVE-2026-44787 was published on July 9, 2026.
What are whispers_allowed_groups in relation to CVE-2026-44787?
Whispers_allowed_groups are configurations in Discourse that could be exploited in CVE-2026-44787 to grant unexpected group privileges.