What is the CVSS score of CVE-2026-44782?

CVE-2026-44782 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44782?

Yes, a patch is available for CVE-2026-44782. Update the affected software to the latest version immediately.

Discourse CVE-2026-44782

EUVD-2026-36585 MEDIUM

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable API endpoint requires only a valid login (PR:L); confidentiality impact is limited to user real names only, with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:35 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, GroupPostSerializer declared include_user_long_name? as the predicate for its :name attribute, but AMS looks for include_name?. The misnamed predicate was never called, so object.user.name was always serialized regardless of SiteSetting.enable_names. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Discourse's GroupPostSerializer leaks user real names to authenticated users even when site administrators have explicitly disabled name display via the enable_names site setting. Affected versions span the 2026.1.x, 2026.3.x, and 2026.4.x release lines. An authenticated user querying group post endpoints receives real name data that the platform operator intended to suppress, undermining privacy configurations on Discourse instances that host pseudonymous or anonymous communities. No public exploit code exists and no active exploitation has been identified; the EPSS score of 0.03% (9th percentile) reflects low exploitation probability.

Technical ContextAI

Discourse is a Ruby on Rails discussion platform that uses the ActiveModelSerializers (AMS) library for JSON serialization. In AMS, conditional attribute inclusion is governed by a predicate method named include_<attribute>?. The GroupPostSerializer incorrectly declared the predicate as include_user_long_name? for its :name attribute, but AMS resolves predicates by the attribute name, so it looks for include_name?. Because the correctly-named predicate was never defined, AMS defaulted to always serializing the attribute, causing object.user.name to be included in every group post response irrespective of the SiteSetting.enable_names flag. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rooted in an API contract misunderstanding - a silent logic error rather than a memory safety or injection flaw. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patches are available; operators should upgrade to Discourse 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on their tracked release branch. The fix corrects the AMS predicate method name from include_user_long_name? to include_name?, restoring proper enforcement of the enable_names site setting. Full advisory details are at https://github.com/discourse/discourse/security/advisories/GHSA-h3mq-9r6w-h33j. As a temporary workaround prior to patching, operators who rely on enable_names=false for user privacy could restrict API access to group post endpoints for untrusted authenticated users via Discourse's trust-level or group permission system, though this may degrade expected platform functionality and is not a substitute for patching.