What is the CVSS score of CVE-2026-44783?

CVE-2026-44783 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44783?

Yes, a patch is available for CVE-2026-44783. Update the affected software to the latest version immediately.

Discourse CVE-2026-44783

EUVD-2026-36586 MEDIUM

Improper Access Control (CWE-284)

2026-06-12 GitHub_M

Authentication Bypass Discourse

5.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-accessible web API requires only a valid forum account (PR:L); integrity limited to whisper channel injection with no availability or significant confidentiality impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:34 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispers_allowed_groups to post into a topic's staff-only whisper channel. The injected content is visible to whisperers (typically staff) alongside legitimate whispers. Only sites that have whispers enabled are affected. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Whisper channel access control in Discourse can be bypassed by any authenticated forum user, allowing injection of content into staff-only whisper threads visible to moderators and staff. Affected release trains span 2026.1.0-latest through pre-2026.1.4, 2026.3.0-latest through pre-2026.3.1, and 2026.4.0-latest through pre-2026.4.1, with all fixes confirmed by the vendor in the GitHub Security Advisory. An attacker holding only a standard forum account can exploit the reply mechanism to post messages that surface inside privileged staff whisper channels, potentially poisoning internal moderation communications or probing staff responses for sensitive operational detail. No public exploit is identified at time of analysis, and EPSS places exploitation probability at the 9th percentile.

Technical ContextAI

Discourse is an open-source Ruby on Rails discussion platform that implements a 'whispers' feature allowing designated staff groups to exchange private, staff-visible-only replies embedded within otherwise-public topics. Access to post whispers is enforced via the site setting 'whispers_allowed_groups'. The root cause (CWE-284: Improper Access Control) lies in the reply handling path: when a user crafts a reply specifically targeting an existing whisper post by its ID, the server-side authorization check does not correctly re-validate group membership against whispers_allowed_groups before accepting the reply as a whisper. This allows a regular authenticated user's post to be treated as a whisper and inserted into the staff-only thread. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* covering all self-hosted and cloud Discourse deployments within the affected version ranges.

RemediationAI

Upgrade to Discourse 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 as confirmed in the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-98ch-mgfj-wqpw. For deployments that cannot patch immediately, disabling the whispers feature entirely via Discourse site settings eliminates the vulnerable code path at the cost of removing staff whisper functionality for all topics until the upgrade can be applied. Raising the minimum trust level required for topic participation narrows the pool of users who could exploit the flaw but does not patch the underlying authorization bypass and should not be treated as a complete mitigation.