CVE-2026-44782: Discourse User Name Exposure via GroupPostSerializer Bypass

Technical summary

The vulnerability stems from a mismatch between the actual predicate name and what the Active Model Serializers (AMS) library expects. GroupPostSerializer declared 'include_user_long_name?' as the predicate for the :name attribute serialization, but AMS searches for 'include_name?' by convention. Because the misnamed predicate was never invoked, the name field serialization always proceeded, bypassing the SiteSetting.enable_names configuration check entirely. This occurs in GroupPostSerializer specifically, affecting how group discussion posts expose user identity information in serialized output.

Business impact

Organizations running Discourse as an internal or external discussion platform may have configured user name anonymity to protect user privacy—whether for compliance, culture, or security reasons. This vulnerability undermines that control by always exposing user names via API responses to anyone with authentication credentials. For communities relying on pseudonymity, healthcare platforms, or other privacy-sensitive deployments, this represents an unauthorized information disclosure that contradicts published security settings and user expectations.

Affected systems

Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are vulnerable. Patched versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 and later. Any Discourse instance running in the affected version ranges with GroupPostSerializer in use is exposed.

Exploitability

Exploitation requires authentication (PR:L in CVSS terms), meaning an attacker must have valid user credentials. No special privileges or user interaction is needed beyond normal API access. An authenticated user can simply query group posts via standard API endpoints and retrieve user names in the response, even if the site administrator explicitly disabled the names feature. This is a straightforward information disclosure—no complex attack steps required.

Remediation

Upgrade immediately to one of the patched versions: 2026.1.4 or later for the 2026.1 branch, 2026.3.1 or later for the 2026.3 branch, 2026.4.1 or later for the 2026.4 branch, or 2026.5.0-latest.1 and later. Verify the patched versions against official Discourse release notes and changelogs. If immediate upgrades are not feasible, audit user access to group post APIs and review logs for unusual data exports or queries.

Patch guidance

Review your current Discourse version against the vulnerable ranges listed in the description. If running 2026.1.x, update to 2026.1.4 or later; if running 2026.3.x, update to 2026.3.1 or later; if running 2026.4.x, update to 2026.4.1 or later. Verify the patch through official Discourse channels, test in a staging environment to confirm the :name predicate now respects SiteSetting.enable_names, and then deploy to production. Restart or reload Discourse services after patching to ensure the updated serializer is active.

Detection guidance

Check your Discourse version number in the admin panel or via API. Compare against the affected ranges. If vulnerable, audit recent API responses from group posts to determine if user names have been exposed. Review access logs for user accounts that queried group post endpoints during the vulnerability window. If you have enabled SiteSetting.enable_names=false, any appearance of user names in API responses during that period indicates exposure. Consider a security review of any exported or cached API responses.

Why prioritize this

Although the CVSS score is moderate (4.3), this issue directly violates an explicit administrator security setting. Organizations that specifically disabled user names did so for documented business or privacy reasons; the fact that those settings are being ignored makes this high-priority from a compliance and trust perspective. The requirement for authentication limits broad exploitation, but any authenticated user—including low-privilege ones—can access the leaked data.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects attack vector network (AV:N, remotely exploitable), low attack complexity (AC:L, straightforward exploitation), low privileges required (PR:L, authentication needed), no user interaction (UI:N), and confidentiality impact (C:L) with no integrity or availability impact. The score appropriately captures that this is a focused information disclosure requiring prior authentication, without system-wide compromise potential. However, the business risk exceeds the technical severity because the leaked data directly contradicts administrator intent.

Frequently asked questions