Discourse CVE-2026-91156

Exploitable only when ALL of the following hold: the Discourse site has Chat enabled; a chat channel is backed by a read-restricted (private) category; the site uses group-based Chat restrictions (e.g. chat_allowed_groups) so that a user can be allowed to view the category while NOT being eligible to use Chat; and the attacker holds an authenticated account that can view that category but is excluded from the Chat-allowed groups. The flaw stems from the MessageBus audience being bounded by category visibility alone (chat/app/services/chat/publisher.rb) without also enforcing Chat eligibility. Limiting factors that reduce realistic risk: an authenticated account with category-view access is required (not anonymous), the category must be read-restricted, and disclosure is bounded to live and recent MessageBus backlog messages - full channel history via the Chat API and any message creation or modification are NOT possible.

This is a genuine but moderate confidentiality-only information-disclosure flaw, not a critical priority. The upstream CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) is internally inconsistent with the description: it sets PR:N (unauthenticated) yet the description explicitly requires 'an authenticated user who could view the category' - so PR should realistically be PR:L, and the true score is lower than 7.5. CVSS also rates C:H, but the description bounds the impact (only live and recent MessageBus backlog content is exposed, not the channel's full history via the Chat API, and no message creation/modification is possible), which argues for a partial rather than total confidentiality loss. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the intelligence, so there is no public exploit identified at time of analysis. Exploitation also requires a specific non-default condition (read-restricted category chat channels combined with group-based Chat eligibility restrictions), further reducing real-world reach. Net: treat as a routine patch-soon issue for Discourse operators using restricted chat, not an emergency; the headline 7.5 overstates urgency given the authenticated prerequisite and bounded disclosure.

A Discourse community restricts the Chat feature to certain groups while letting a broader set of authenticated members view a read-restricted category. A member who can see the category but is barred from Chat subscribes to the MessageBus channel and passively receives live and recent chat messages from that category's channel that they should not be able to read. No public exploit code is available, but the attack needs only normal authenticated access and low complexity (AC:L).