CVE-2026-44786: Discourse Chat Message Disclosure in MessageBus

Technical summary

The vulnerability exists in Discourse's MessageBus event publication mechanism for chat functionality. When chat events are generated for public category channels, the system publishes these events to MessageBus subscribers without implementing adequate permission scoping or authorization checks. Specifically, MessageBus subscribers without chat features enabled can receive chat message payloads in real time due to missing access control validation. The flaw is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and affects multiple release branches: versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0. The patched versions—2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1—implement proper authorization filtering before publishing chat events to MessageBus.

Business impact

Public category chat messages, which organizations may assume are visible only to intended participants, are exposed to a wider audience than intended. For Discourse instances used internally or as customer-facing communities, this creates information disclosure risk: sensitive customer inquiries, internal team discussions, or confidential project details in public channels could be read by users who should not have access. The impact depends on what content is posted in public category channels—some organizations may tolerate low risk if public channels contain only non-sensitive content, while others may face compliance or trust violations. Patching is straightforward and carries minimal operational risk, making this a clear priority for any Discourse deployment handling sensitive discussions.

Affected systems

Discourse installations running versions 2026.1.0 through 2026.1.3, 2026.3.0 (and related builds through 2026.3.0), and 2026.4.0 (and related builds through 2026.4.0) are affected. The 2026.2.x release line does not appear in the affected list, suggesting it may not have included the vulnerable code path, but admins should verify their exact version. Patched versions include 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Self-hosted Discourse instances, Discourse Cloud customers, and any deployment using the affected release branches are in scope.

Exploitability

The vulnerability requires no authentication and no user interaction—any MessageBus subscriber can receive chat event payloads automatically as they are published. The network is accessible remotely. However, practical exploitation depends on the attacker's ability to subscribe to MessageBus, which may require some level of access to the Discourse instance (e.g., being a regular user with at least read access). The attack is passive eavesdropping rather than active manipulation; attackers cannot modify messages or disrupt service. The CVSS score of 7.5 reflects high confidentiality impact with network-accessible attack vector and low complexity. Public category channels are, by design, readable by many users; the flaw is that the content is also leaked outside normal access control boundaries to administrative or bot subscribers of MessageBus who shouldn't see it.

Remediation

Upgrade to Discourse version 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 or later, depending on which release branch you are on. These versions incorporate permission scoping for chat event publication to MessageBus. Before upgrading in production, test in a staging environment to ensure compatibility with any custom plugins or integrations. Most Discourse instances using managed hosting will receive updates automatically; self-hosted instances should initiate upgrades immediately.

Patch guidance

Check your current Discourse version via the admin panel (Admin > About). Identify which release branch you are on (2026.1.x, 2026.3.x, 2026.4.x, or later). If you are on 2026.1.x, upgrade to 2026.1.4 or later. If on 2026.3.x, upgrade to 2026.3.1 or later. If on 2026.4.x, upgrade to 2026.4.1 or later. If on 2026.5.0 or later, verify you are on 2026.5.0-latest.1 or a newer patch. Managed Discourse Cloud instances typically auto-update; verify the update status in your account dashboard. Self-hosted deployments should use your standard Discourse upgrade process (e.g., Docker rebuild, or via the web interface). Test the upgrade in a non-production environment first.

Detection guidance

Review MessageBus subscriber logs to identify which subscribers have received chat event payloads. On self-hosted instances, examine request logs or MessageBus diagnostic data for subscribers accessing chat event channels without explicit chat permissions. Monitor for unusual subscriber accounts (e.g., bot or admin accounts) subscribing to or receiving chat events. In the interim before patching, restrict who can subscribe to MessageBus if operationally feasible, or limit chat usage to private categories and direct messages. Check your instance logs for signs of unauthorized access attempts correlated with the vulnerability timeframe.

Why prioritize this

A CVSS 7.5 HIGH-severity information disclosure in a widely deployed discussion platform warrants immediate attention. Although the vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, the ease of exploitation (no authentication required, passive eavesdropping), the sensitive nature of chat communication, and the availability of ready patches makes this a top priority. Organizations running affected Discourse versions should patch within their standard critical-patch window.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is assigned using vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This reflects: Network-accessible attack vector (AV:N), Low attack complexity (AC:L), No privilege requirement (PR:N), No user interaction (UI:N), Unchanged scope (S:U), High confidentiality impact (C:H) due to exposure of chat message content, No integrity impact (I:N), and no availability impact (A:N). The score appropriately penalizes the lack of access controls and broad exposure of sensitive data, but does not reach CRITICAL (9.0+) because there is no integrity compromise, availability impact, or change in privilege scope.

Frequently asked questions