CVE-2026-91156: Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.9.0 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.9
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users who can view a read-restricted category but are excluded from using Chat by the site's group restrictions may receive chat messages from that category's channel.
What information can an unauthorized user obtain?
The user may receive live and recent message content retained in the MessageBus backlog. They cannot retrieve the channel's full history through the Chat API.
Can an attacker post, alter, or otherwise manage chat messages?
No. The issue does not permit message creation or modification.
What versions contain fixes?
The issue is fixed in Discourse versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.