Executive brief
Discourse, a popular open-source discussion and community platform, was found to have a flaw in how it handles real-time chat messages. Due to a lack of permission checks, chat messages from public channels were being broadcast to users who should not have had access to them, including anonymous visitors. This could lead to the unauthorized exposure of real-time conversations to individuals who do not have chat privileges enabled.
Technical details
A vulnerability in Discourse's chat plugin (CWE-200) occurs because chat events for public category channels are published to the MessageBus without adequate permission scoping. This allows any MessageBus subscriber, including anonymous clients or users without chat enabled, to receive real-time chat message payloads. The root cause is the lack of restriction on the 'everyone' group within the MessageBus broadcast logic. The issue has been addressed by scoping public-channel broadcasts to 'chat_allowed_groups' and remapping the 'everyone' group to 'trust_level_0' to exclude anonymous clients. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.
Affected products
- Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1
Timeline
- 2026-05-18: advisory: GitHub Security Advisory published
- 2026-06-12: disclosed: CVE published to NVD