What is the CVSS score of CVE-2026-44779?

CVE-2026-44779 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44779?

Yes, a patch is available for CVE-2026-44779. Update the affected software to the latest version immediately.

Discourse CVE-2026-44779

EUVD-2026-36583 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible debug endpoint requires only a low-privilege authenticated session; confidentiality limited to audit log disclosure with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:36 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, bot debug endpoints disclose whisper translation audit logs. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Discourse platform versions across three active release tracks expose whisper translation audit logs through bot debug endpoints to any authenticated low-privilege user. The vulnerability (CWE-200) exists across release lines 2026.1.x, 2026.3.x, and 2026.4.x, and has been patched by the vendor across all affected tracks. No public exploit exists and EPSS sits at the 9th percentile (0.03%), indicating this is a low-probability exploitation target; however, the exposure of internal moderation audit logs may pose compliance and confidentiality risks on community platforms handling sensitive staff communications.

Technical ContextAI

Discourse is an open-source Ruby on Rails-based discussion platform (CPE: cpe:2.3:a:discourse:discourse:*). The affected component is a bot debug endpoint that improperly exposes whisper translation audit logs. In Discourse, 'whispers' are staff-only private posts invisible to regular users, and translation audit logs capture activity around content moderation workflows. The root cause is CWE-200 (Exposure of Sensitive Information to Unauthorized Actor): the debug endpoint fails to apply appropriate authorization checks, allowing users authenticated with low privileges to retrieve data scoped to privileged moderation actions. The CVSS vector AV:N/AC:L/PR:L confirms the endpoint is network-accessible and requires only a standard authenticated session, with no elevated role needed.

RemediationAI

Upgrade Discourse to one of the vendor-patched releases: version 2026.1.4 (for the 2026.1.x track), version 2026.3.1 (for the 2026.3.x track), version 2026.4.1 (for the 2026.4.x track), or the rolling 2026.5.0-latest.1 release. Full details are available in the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-x6mr-wjq6-495j. If an immediate upgrade is not possible, consider restricting network-level access to debug or internal bot API endpoints via reverse proxy rules (e.g., deny access to the bot debug endpoint path for non-admin roles at the web server layer) - note this may impair bot diagnostics and operator tooling. Monitor access logs for unexpected queries to bot-related endpoints as a detection measure.