CVE-2026-45085: Discourse: Chat misauthorization and information disclosure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclosure issues in the chat plugin (one also involving discourse-calendar): read-only category users could create chat threads, self-deleted chat messages could be restored by their author after channel access was revoked, moderators reviewing a flagged chat message were shown the channel's current lastmessage (often unrelated DM content), and calendar event payloads exposed the attached chat channel and its last message to viewers without chat access (including anonymous users). This affects sites with the chat plugin enabled; the calendar issue additionally requires discourse-calendar. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.4 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.4.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.0-latest.1 - Remove
Remove
Discourse (chat plugin)from your environment.Disable or uninstall the chat plugin until Discourse is upgraded to one of the patched versions (e.g., 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1). This mitigates the chat authorization and disclosure issues for sites with the chat plugin enabled.
- Remove
Remove
Discourse (discourse-calendar)from your environment.If discourse-calendar is installed and calendar functionality is not required, disable or uninstall the discourse-calendar plugin until Discourse is upgraded to a patched version (e.g., 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1). This prevents the calendar-related disclosure of chat channel and last message data to viewers without chat access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45085?
The severity of CVE-2026-45085 is medium with a CVSS score of 5.3.
How do I fix CVE-2026-45085?
To fix CVE-2026-45085, update Discourse to version 2026.1.4, 2026.3.1, or 2026.4.1 or later.
What are the main issues related to CVE-2026-45085?
CVE-2026-45085 involves authorization and information disclosure issues in the chat plugin of Discourse.
Which versions of Discourse are affected by CVE-2026-45085?
CVE-2026-45085 affects Discourse versions 2026.1.0 to before 2026.1.4, 2026.3.0 to before 2026.3.1, and 2026.4.0 to before 2026.4.1.
What type of vulnerability is CVE-2026-45085 categorized as?
CVE-2026-45085 is categorized as an information leakage vulnerability.