What is the CVSS score of CVE-2026-44786?

CVE-2026-44786 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-44786?

Discourse discussion platform versions 2026.1.0-2026.4.0 contain an information disclosure vulnerability that allows unauthenticated attackers to intercept real-time chat messages from public…. A patch is available.

How to fix or mitigate CVE-2026-44786?

Within 24 hours: Identify all Discourse deployments and determine which are running versions 2026.1.0-2026.4.0. Within 7 days: Upgrade to patched versions-2026.1.4 (for 2026.1.x branch), 2026.3.1 (for 2026.3.0), 2026.4.1 (for 2026.4.0), or 2026.5.0-latest.1 (recommended for all users). Within 30 days: Validate patches are applied successfully and review MessageBus access logs from the vulnerability window for signs of unauthorized message access.

Discourse CVE-2026-44786

EUVD-2026-36582 HIGH

Information Exposure (CWE-200)

2026-06-12 GitHub_M

Information Disclosure Discourse

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.3 MEDIUM

Realistic attacker is an authenticated forum user subscribing to MessageBus (PR:L), and only public-category chat content leaks, so confidentiality impact is limited (C:L), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:23 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Information disclosure in Discourse discussion platform allows any MessageBus subscriber to receive real-time chat message payloads from public category channels without proper permission scoping, even when chat is not enabled for that user. The flaw affects versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0, and is fixed in 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. No public exploit identified at time of analysis, but the unauthenticated network attack vector makes this a meaningful confidentiality concern for forums leveraging chat.

Technical ContextAI

Discourse uses MessageBus, a long-polling pub/sub bus, to push real-time updates (notifications, posts, chat events) to subscribed clients. The vulnerability is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) caused by chat events for public category channels being published to MessageBus channels without applying the chat-permission scoping that should restrict delivery to users with chat actually enabled. Because MessageBus delivery is based on the channel/topic name a client subscribes to, any subscriber that knows or guesses the public chat event channel receives the payloads. The affected package per CPE is cpe:2.3:a:discourse:discourse on all listed versions in the vulnerable ranges.

RemediationAI

Vendor-released patch: upgrade Discourse to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 as appropriate for your release train, per advisory https://github.com/discourse/discourse/security/advisories/GHSA-j7wq-rf5c-8783. If patching must be deferred, compensating controls include disabling the chat plugin entirely (eliminates the leak but removes chat functionality for all users), restricting use of public-category chat channels and moving sensitive discussion to private categories or DMs (reduces exposure but does not close the bug for any remaining public channels), or fronting MessageBus endpoints with an authenticating reverse proxy that blocks unauthenticated subscribers (reduces anonymous abuse but does not stop authenticated forum users without chat enabled from subscribing).