Is CVE-2026-44786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44786 being exploited in the wild.

How severe is CVE-2026-44786?

High severity, with a CVSS score of 7.5, published 12 June 2026.

Which products and versions are affected?

Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1.

Is there a fix for CVE-2026-44786?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-44786 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44786?

Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44786: Discourse information disclosure in public chat channels

CVE-2026-44786 · Severity: high · CVSS 7.5 · Published 2026-06-12

Discourse, a popular open-source discussion and community platform, was found to have a flaw in how it handles real-time chat messages. Due to a lack of permission checks, chat messages from public channels were being broadcast to users who should not have had access to them, including anonymous visitors. This could lead to the unauthorized exposure of real-time conversations to individuals who do not have chat privileges enabled.

Technologies: Discourse. Vendors: Discourse.

Quick answers

Is CVE-2026-44786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44786 being exploited in the wild.
How severe is CVE-2026-44786?: High severity, with a CVSS score of 7.5, published 12 June 2026.
Which products and versions are affected?: Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1.
Is there a fix for CVE-2026-44786?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44786 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44786?: Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Discourse's chat plugin (CWE-200) occurs because chat events for public category channels are published to the MessageBus without adequate permission scoping. This allows any MessageBus subscriber, including anonymous clients or users without chat enabled, to receive real-time chat message payloads. The root cause is the lack of restriction on the 'everyone' group within the MessageBus broadcast logic. The issue has been addressed by scoping public-channel broadcasts to 'chat_allowed_groups' and remapping the 'everyone' group to 'trust_level_0' to exclude anonymous clients. Patches are available in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Affected products

Discourse Discourse 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, 2026.4.0-latest to before 2026.4.1

Timeline

2026-05-18: advisory: GitHub Security Advisory published
2026-06-12: disclosed: CVE published to NVD

References

https://github.com/discourse/discourse/security/advisories/GHSA-j7wq-rf5c-8783

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.