CVE-2026-44785: Discourse AI Explain Feature Authorization Bypass

Technical summary

The vulnerability stems from incomplete authorization logic in Discourse's AI explain helper. The feature implements a can_see? check on the post object under explanation but fails to validate permissions against the reply_to_post field. An authenticated attacker can traverse the post hierarchy by invoking the explain action on a child post, bypassing the access control that should prevent reading parent posts marked as hidden, private, or otherwise restricted. This is a classic case of inconsistent authorization policy (CWE-200) where one resource's visibility does not propagate to dependent resources in the access check.

Business impact

Organizations running Discourse as a communication platform face information disclosure risk. If posts are marked hidden or restricted to limit audience visibility—whether for moderation, confidentiality, or workflow reasons—those restrictions can be circumvented by users with AI helper access. This undermines content governance, may expose sensitive discussions or moderation decisions, and could breach confidentiality expectations in community or enterprise deployments. The impact is narrowed to authenticated users, reducing but not eliminating risk in public or semi-public communities.

Affected systems

Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are vulnerable. Patched versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Self-hosted and cloud-hosted Discourse instances running unpatched code in these ranges require immediate attention.

Exploitability

Exploitation requires authentication and the presence of an enabled AI helper, making this a low-barrier but not zero-friction attack. An attacker with valid forum credentials can perform the attack without user interaction, network complexity, or special tools—just the ability to submit an explain request. The simplicity of the attack vector and absence of compensating controls in the feature itself make this relatively straightforward to execute once the permission gap is understood. However, the requirement for authentication and the need for a visible reply to a hidden post limit the real-world attack surface in many deployments.

Remediation

Apply patches immediately: upgrade to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on your current version branch. If patching is delayed, consider temporarily disabling the AI explain feature via Discourse admin settings until updates can be deployed. Verify that access control changes propagate to all connected instances and that cache invalidation occurs after upgrade.

Patch guidance

Discourse provides version-specific patches aligned with its release branches. Review your current version in the Discourse admin interface and cross-reference it against the vulnerable ranges. If you are on 2026.1.x, update to 2026.1.4 or later; if on 2026.3.x, update to 2026.3.1 or later; if on 2026.4.x, update to 2026.4.1 or later; if on 2026.5.x or later, ensure you have 2026.5.0-latest.1 or a subsequent release. Consult the Discourse release notes and security advisories for any breaking changes or additional configuration requirements.

Detection guidance

Monitor Discourse logs for repeated explain API calls targeting posts that are not visible to the requesting user. Correlate AI helper activity with subsequent access patterns to hidden content. Review audit trails if available to identify which posts were explained and by whom. Proactively audit user permissions and post visibility settings to identify which content was at risk. If Discourse provides request logging, filter for POST requests to explain endpoints and flag those that succeed on non-visible parent posts.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), the combination of easy exploitability, authentication-only barrier, and the breach of fundamental access control principles warrants prompt patching. The flaw directly violates the principle that hidden content should remain hidden. Most organizations treat unauthorized information disclosure seriously, even at MEDIUM severity, because the business and compliance implications often outweigh the numeric score. Prioritize this for patching within your normal vulnerability management cadence.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability requiring valid credentials, with low attack complexity, no user interaction, and limited scope. The impact is confidentiality only (information disclosure), with no direct integrity or availability effects. The score appropriately captures that an authenticated user must invoke the explain feature, but it does not fully account for the ease of discovering and exploiting the flaw once understood or the severity of intentional post-hiding schemes being circumvented.

Frequently asked questions