What is the CVSS score of CVE-2026-44787?

CVE-2026-44787 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Discourse are affected by CVE-2026-44787?

Discourse installations with whisper-group functionality are vulnerable to CVE-2026-44787, a privilege escalation flaw allowing newly registered users unauthorized access to staff-only confidential…. A patch is available.

How to fix or mitigate CVE-2026-44787?

Within 24 hours, identify all Discourse installations in your environment and confirm which have whispers_allowed_groups enabled, as only those configurations face risk. Within 7 days, apply the vendor-released patch per GHSA-vmwq-jvxx-jwfx advisory to all affected instances, prioritizing production deployments. Within 30 days, audit whisper-group access logs for indicators of unauthorized access and verify patching completion across your Discourse fleet.

Discourse CVE-2026-44787

EUVD-2026-42735 HIGH

Improper Privilege Management (CWE-269)

2026-07-09 security-advisories@github.com

Privilege Escalation Discourse

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (github) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Patch tests show injection succeeds on unauthenticated signup, so PR:N and AC:L; whisper read access drives C:H with minor I:L and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 14, 2026 - 20:59 vuln.today

Analysis Updated

Jul 14, 2026 - 20:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 14, 2026 - 20:52 vuln.today

cvss_changed

CVSS changed

Jul 14, 2026 - 20:52 NVD

8.2 (HIGH) 7.1 (HIGH)

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:31 vuln.today

DescriptionNVD

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Privilege escalation in Discourse (the open-source discussion platform) lets a newly registered user obtain whisper-group ('whisperer') privileges by supplying a primary_group_id during the signup flow, without ever being a legitimate member of that group. Exploitation only matters on sites that have configured whispers_allowed_groups, and success grants read access to staff-only whisper posts (a confidentiality-focused impact). EPSS is low (0.31%, 23rd percentile) and there is no public exploit identified at time of analysis, but the fix commits and GitHub advisory GHSA-vmwq-jvxx-jwfx confirm the flaw and its remediation.

Technical ContextAI

Discourse is a Ruby on Rails discussion/forum platform. This is a CWE-269 Improper Privilege Management issue spanning the account-creation path (UsersController#create) and the Roleable concern. Signup parameters were passed through with only :timezone stripped, letting an attacker inject :primary_group_id (and :flair_group_id). Separately, Roleable#whisperer? treated any user whose primary_group_id was contained in SiteSetting.whispers_allowed_groups_map as a whisperer, so pointing primary_group_id at an allowed group synthesized the privilege with no real membership. The CPE data (cpe:2.3:a:discourse:discourse) confirms the affected product is the Discourse application itself, with the fix landing in tagged release 2026.6.0.

RemediationAI

Vendor-released patch: upgrade to Discourse 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 (whichever matches your release branch), available at https://github.com/discourse/discourse/releases (tags v2026.6.0, v2026.5.1, v2026.4.2, v2026.1.5). The fix strips primary_group_id and flair_group_id from non-admin/non-API signup parameters and stops treating primary_group_id alone as a source of whisper privileges. As an interim compensating control where you cannot patch immediately, temporarily clear or unset the whispers_allowed_groups site setting to neutralize the impact (trade-off: this disables group-based whisper access for legitimate staff), and audit recently created accounts for unexpected primary_group_id/flair_group_id values pointing at whisper-allowed groups, resetting any that lack genuine membership. Details are in advisory GHSA-vmwq-jvxx-jwfx and commit 012796ac28c85b30aa233c5ef042fc66efff8126.