Discourse EUVD-2026-36586

Exploitation requires an authenticated session as any registered Discourse user - the CVSS vector PR:L confirms authentication is a hard prerequisite; unauthenticated visitors cannot exploit this flaw. The target Discourse instance must have the whispers feature explicitly enabled via site settings; the vendor explicitly states that sites without whispers enabled are not affected, making this a non-default configuration requirement. Additionally, a whisper post must already exist in a topic the attacker can access so that the reply-targeting mechanism can be abused. Limiting factors are: (1) valid forum account required, (2) whispers must be site-enabled, and (3) a pre-existing whisper post must be present in an accessible topic. These conditions substantially narrow realistic exposure compared to the raw CVSS network vector would suggest.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N produces a Medium score of 5.4, accurately reflecting low-complexity network exploitation by authenticated users with no scope change. Both Confidentiality and Integrity are rated Low: the attacker can inject content (integrity) and implicitly confirm their post was silently accepted into the whisper channel (limited confidentiality leakage). EPSS at 0.03% (9th percentile) is consistent with the narrow exploitation prerequisites - the whispers feature must be deliberately enabled and the attacker must already hold a forum account - making mass opportunistic exploitation unlikely. This vulnerability is not listed in CISA KEV and no POC is publicly known, keeping real-world urgency moderate. The primary realistic threat is a disgruntled or malicious community member abusing their existing account to disrupt or manipulate staff internal communications, not an external mass-exploitation campaign. No conflicts exist between the CVSS signals and the description; the Medium rating is appropriate.

An authenticated Discourse forum member without staff privileges identifies a topic containing a whisper post - detectable because a reply exists but its content is hidden. The attacker crafts an API request to post a reply explicitly targeting the whisper post's ID, triggering the flawed reply handler that fails to re-check whispers_allowed_groups membership. The attacker's message is inserted into the staff whisper thread and becomes visible to staff, allowing the attacker to inject misinformation, spam, or social-engineering content into privileged moderation channels. No public exploit code is identified at time of analysis.