Discourse CVE-2026-44785

Exploitation requires a valid authenticated Discourse session with access to the AI 'explain' helper feature (PR:L per CVSS). The target instance must have the AI helper enabled (non-default configuration for many self-hosted instances). At least one hidden post must exist in a category the attacker can access, and that hidden post must have at least one visible reply that the attacker can target for the 'explain' invocation. Unauthenticated visitors cannot exploit this flaw. The confidentiality breach is limited to the raw text of a single hidden parent post per invocation - there is no known path to bulk enumeration of hidden content or access to posts in categories the attacker cannot otherwise reach. Deployments where no hidden posts exist or where AI helper access is limited to users who already have visibility into all posts face no meaningful exposure.

The CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N correctly characterizes this as a low-privilege, network-exploitable flaw with limited confidentiality impact - no integrity or availability consequences exist. The EPSS score of 0.03% at the 9th percentile, combined with the absence of a CISA KEV listing and no identified public POC, collectively indicate minimal near-term exploitation probability. Real-world risk is tightly bounded: attackers must hold a valid authenticated session and the AI helper must be enabled; unauthenticated users are entirely excluded. Impact is scoped to reading one hidden post per invocation - there is no privilege escalation, no lateral movement, and no bulk data exfiltration path identified. For most deployments, this is a low-urgency patch; for communities where hidden posts contain sensitive moderation notes, staff discussions, or user-reported data, the realistic risk is meaningfully higher than raw CVSS suggests because the bypassed content is specifically intended to be access-controlled.

An authenticated forum member navigates to any thread where a visible reply exists to a hidden or staff-only parent post. The attacker invokes the AI 'explain' feature on the visible reply, causing the AI backend to fetch and process the hidden parent post without a visibility check, returning its raw contents in the explanation response. No special tooling or exploit code is required - the attack is achievable through normal forum UI interactions by any user with access to the AI helper.