Vulnerability in Discourse Open-Source Discussion Platform Affects Whisper Channel Security
CVE-2026-44783

5.4MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
12 June 2026

What is CVE-2026-44783?

A flaw in the Discourse platform affects how replies to whisper posts are managed, allowing authenticated users outside designated whisper groups to interfere with staff-only channels. This vulnerability can lead to exposed content intended for a limited audience, making it crucial for administrators to ensure they are on patched versions to maintain the integrity of whisper functionalities. The issue is addressed in the latest releases, ensuring better control over group communication.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.4 < 2026.1.0-latest, 2026.1.4

discourse >= 2026.3.0-latest, < 2026.3.1 < 2026.3.0-latest, 2026.3.1

discourse >= 2026.4.0-latest, < 2026.4.1 < 2026.4.0-latest, 2026.4.1

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.