CVE-2026-45085: Discourse Chat Plugin Authorization and Information Disclosure Flaws

Technical summary

CVE-2026-45085 encompasses four distinct authorization bypasses and information disclosures in Discourse's chat plugin. First, read-only users in a category can circumvent restrictions by creating chat threads within that category. Second, a post-deletion restoration flaw allows message authors to recover self-deleted chat messages even after their access to the containing channel has been revoked, exploiting a gap between deletion and access control enforcement. Third, the chat flag review workflow inadvertently exposes the channel's current last_message to moderators, which may contain unrelated or sensitive direct message content unrelated to the flagged item. Fourth, calendar event detail payloads embed references to attached chat channels and their last messages, making these details visible to any user viewing the calendar event—including those without chat plugin access and anonymous users. The underlying root causes involve insufficient permission checks at message recovery time, overly broad data inclusion in API responses, and failure to filter sensitive fields based on viewer access scope.

Business impact

For organizations using Discourse as a community, customer, or internal discussion platform, these vulnerabilities create three material risks. First, information leakage exposes sensitive private messages and channel metadata to users who should not see them, potentially compromising confidential discussions, support conversations, or internal coordination. Second, circumvention of read-only roles undermines moderation policies and governance structures by allowing restricted users to create new threads outside their intended scope. Third, message recovery after access revocation can be leveraged to extract content after a user's permissions are withdrawn, defeating the intent of channel removal or role downgrade. Organizations with multiple channels handling sensitive data—such as customer support, internal discussions, or compliance-sensitive topics—face elevated risk of unintended disclosure.

Affected systems

Discourse versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are affected. The vulnerabilities require the chat plugin to be enabled. The calendar event payload disclosure additionally requires the discourse-calendar plugin. Patched versions are 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Any Discourse instance running an affected version with chat enabled should be considered at risk; the calendar-specific exposure is limited to instances also running discourse-calendar.

Exploitability

These vulnerabilities require no special interaction, credentials beyond basic user registration, or exploitation tools—they operate through normal platform use. A low-privilege user (read-only role, revoked access, or anonymous viewer) can trigger the flaws simply by performing ordinary actions: creating a thread, attempting message recovery, or viewing a calendar event. The network vector and low complexity mean exploitation can occur remotely with minimal friction. However, KEV does not currently list this vulnerability, suggesting no evidence of active, weaponized exploitation in the wild at publication time. The relative simplicity of triggering these flaws and the sensitive nature of the data exposed (private messages, user metadata) make post-patch validation critical.

Remediation

Apply the vendor-provided patches immediately: update to Discourse 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on your current version. These releases close the authorization gaps, prevent unwarranted message recovery, and restrict sensitive field visibility to authorized users. If you cannot patch immediately, consider disabling the chat plugin and discourse-calendar plugin until updates are applied, though this may disrupt user workflows. After patching, test the following scenarios: confirm read-only users cannot create threads, verify deleted messages cannot be recovered after access revocation, and check that moderators reviewing flags see only the flagged message context (not unrelated channel content). Additionally, audit recent chat channel access and calendar event views to identify whether the exposure window affected sensitive content.

Patch guidance

Upgrade Discourse to the appropriate patched version: 2026.1.4 if running 2026.1.x, 2026.3.1 if running 2026.3.x, 2026.4.1 if running 2026.4.x, or 2026.5.0-latest.1 if running 2026.5.x. Verify against the official Discourse release notes and security advisories to confirm the exact patch version for your deployment. Test the upgrade in a staging environment first, particularly if you rely on custom plugins or have high-traffic chat activity. After production deployment, confirm that the chat plugin and calendar plugin (if installed) are operating normally and that permission checks are enforced (e.g., spot-check that read-only users cannot create threads, and that revoked users cannot restore deleted messages).

Detection guidance

Monitor Discourse logs for signs of exploitation: (1) unusual thread creation by users with read-only roles in specific categories; (2) rapid or repeated message deletion and recovery attempts by the same user, especially after access revocation; (3) excessive requests to moderator flag-review endpoints from accounts that may be scraping flag context for unrelated message content; and (4) calendar event detail requests from anonymous or low-privilege users, followed by access attempts to referenced chat channels. If your Discourse instance has audit logging enabled, review logs for permission bypass patterns. Forensically, examine the chat_messages and chat_threads tables for creation timestamps by read-only users, and check message recovery timestamps against channel access revocation events in the user_custom_fields and category_users tables.

Why prioritize this

Although the CVSS score of 5.3 (MEDIUM) reflects low confidentiality impact and no integrity or availability damage, the vulnerability should be prioritized for rapid patching due to its high practical exploitability and the sensitive nature of chat data. The flaws are effortless to trigger and leak private messages and metadata with no user interaction or privileged access required. Organizations handling customer support, compliance, or internal coordination through Discourse should treat this as high priority. The absence of KEV designation and lack of widespread exploitation should not lower urgency—these issues are recent and straightforward to exploit once discovered by adversaries or determined insiders.

Risk score, explained

The CVSS:3.1 score of 5.3 reflects a network-based vulnerability with low complexity and no privileges or user interaction required, yielding a base score in the MEDIUM range. The attack vector is network, complexity is low, and no privileges or interaction are needed (PR:N, UI:N), which would drive a higher score. However, the impact is limited to confidentiality (C:L) with no integrity or availability damage (I:N, A:N), capping the score. In context, the practical risk is elevated: the vulnerability enables information disclosure of sensitive communications with minimal effort, and circumvents role-based access controls. Organizations should not treat MEDIUM severity as low-risk; the ease of exploitation and data sensitivity warrant expedited patching.

Frequently asked questions