Discourse CVE-2026-44779

Exploitation requires a valid authenticated session on the Discourse instance with at least low-privilege access (a standard registered user account); PR:L in the CVSS vector confirms authentication is mandatory. The vulnerable functionality is tied specifically to bot debug endpoints - deployments that do not use Discourse's bot or translation features may still expose these endpoints if the code path is present. Exploitation is limited to Discourse instances running affected versions in the 2026.1.x, 2026.3.x, or 2026.4.x release tracks. Unauthenticated access is not possible (PR:L, not PR:N). The scope of exposed data is limited to whisper translation audit logs rather than full database or credential access.

CVSS scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating a network-accessible, low-complexity flaw requiring authenticated access. All signals converge on low real-world urgency: EPSS is 0.03% (9th percentile), far below thresholds typically associated with active exploitation pressure; the vulnerability is not listed in CISA KEV; and no public exploit code has been identified. The impact is limited to confidentiality (C:L) with no integrity or availability consequence. The primary risk is to Discourse deployments where whisper/moderation activity is sensitive - for example, platforms handling legal or HR discussions. For standard community forums with low-sensitivity moderation content, actual business impact is minimal. SSVC would likely score this as 'Track' rather than 'Attend', given no active exploitation and low automatability for meaningful impact.

An authenticated Discourse user with a standard (low-privilege) account queries the bot debug API endpoint directly, receiving a response that includes whisper translation audit log entries intended only for staff. No public exploit code exists at time of analysis, but the attack is low-complexity and requires only a valid session cookie and knowledge of the endpoint path.