Executive brief
Discourse, a popular open-source discussion platform, contains a flaw in its 'whisper' feature, which is used for private staff-only communications within public topics. An authenticated user can bypass security restrictions to post messages into these private staff channels. This could allow unauthorized users to inject misleading information or disrupt internal staff discussions, though it only affects sites where the whisper feature is enabled.
Technical details
An improper access control vulnerability (CWE-284) exists in Discourse's handling of replies to 'whisper' posts. Authenticated users who are not members of the 'whispers_allowed_groups' can exploit this flaw to inject content into the staff-only whisper channel of a topic. The attack is carried out over the network with low privileges and requires no user interaction. While the attacker can post to the channel, the primary impact is on integrity and confidentiality as they can insert messages visible to staff. The issue is patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1
Timeline
- 2026-05-18: advisory: GitHub advisory published by maintainers
- 2026-06-12: disclosed: CVE published to NVD