CVE-2026-44787

HIGH

Discourse: Signup-time primary_group_id assignment grants whisperer access

Title source: cna
STIX 2.1

Description

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

References (9)

Core 9
Core References

Scores

CVSS v3 8.2
EPSS 0.0031
EPSS Percentile 22.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-269
Status published
Products (3)
discourse/discourse >= 2026.1.0-latest, < 2026.1.5
discourse/discourse >= 2026.4.0-latest, < 2026.4.2
discourse/discourse >= 2026.5.0-latest, < 2026.5.1
Published Jul 09, 2026
Tracked Since Jul 10, 2026