What is the CVSS score of CVE-2026-45085?

CVE-2026-45085 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45085?

Yes, a patch is available for CVE-2026-45085. Update the affected software to the latest version immediately.

Discourse CVE-2026-45085

EUVD-2026-36558 MEDIUM

Missing Authorization (CWE-862)

2026-06-12 GitHub_M

Authentication Bypass Discourse

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:N captures the anonymous calendar disclosure vector; I:L added because read-only users can create threads and authors can restore deleted messages, impacts the published vector omits.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 12, 2026 - 22:01 EUVD

Analysis Generated

Jun 12, 2026 - 21:32 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclosure issues in the chat plugin (one also involving discourse-calendar): read-only category users could create chat threads, self-deleted chat messages could be restored by their author after channel access was revoked, moderators reviewing a flagged chat message were shown the channel's current last_message (often unrelated DM content), and calendar event payloads exposed the attached chat channel and its last message to viewers without chat access (including anonymous users). This affects sites with the chat plugin enabled; the calendar issue additionally requires discourse-calendar. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AnalysisAI

Discourse chat plugin across versions 2026.1.0-2026.4.x contains four authorization deficiencies (CWE-862) enabling both information disclosure and unauthorized write actions: calendar event API payloads expose the associated chat channel's last message - potentially a private DM - to unauthenticated users, while separate flaws allow read-only users to create chat threads, authors to restore their own deleted messages after losing channel access, and moderators reviewing flagged messages to inadvertently view unrelated DM content. Vendor-released patches exist for all supported branches; no public exploit identified at time of analysis and EPSS is 0.04% (11th percentile), but the unauthenticated DM disclosure warrants prompt patching on public-facing instances.

Technical ContextAI

Discourse is a Ruby on Rails discussion platform whose chat functionality is provided as a bundled plugin; calendar integration is provided by the separate discourse-calendar plugin. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*. CWE-862 (Missing Authorization) underlies all four issues: the codebase fails to verify that the requester holds the necessary chat-access permissions before returning chat channel metadata or permitting write operations. Specifically, the calendar event serializer includes chat channel and last_message fields without gating on the viewer's chat visibility, and the chat thread creation endpoint does not enforce the read-only category constraint. The self-deleted-message restoration path bypasses the channel-revocation check, and the moderation review endpoint leaks cross-channel last_message data to moderators whose review context is a different channel.

RemediationAI

Vendor-released patches are available: upgrade Discourse to version 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 as applicable to the installed release branch, per the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-rw8j-p2gv-q33w. For sites unable to patch immediately, disabling the discourse-calendar plugin eliminates the unauthenticated DM-exposure vector - the most severe of the four issues - at the cost of removing all calendar functionality. Restricting calendar event access to authenticated users only reduces the anonymous exposure surface but does not address the three remaining authenticated authorization bypasses. Disabling the chat plugin entirely mitigates all four issues but removes all chat functionality. No workaround fully eliminates all four issues without patching.