# CVE-2026-44787: Discourse privilege escalation in signup flow

Source: https://junglewise.ai/threats/cve-2026-44787-discourse-privilege-escalation-in-signup-flow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-44787 · Severity: high · CVSS 8.2 · Published 2026-07-09

Discourse, a popular open-source discussion and community platform, contained a flaw in its user registration process. An attacker could exploit this during signup to grant themselves unauthorized access to "whisper" groups, which are typically reserved for staff or moderators to discuss sensitive information privately. This could lead to the exposure of confidential internal discussions and community management data.

Technologies: [Discourse](https://junglewise.ai/threats/technologies/discourse). Vendors: [Discourse](https://junglewise.ai/threats/vendors/discourse).

## Quick answers

**Is CVE-2026-44787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44787 being exploited in the wild.

**How severe is CVE-2026-44787?** High severity, with a CVSS score of 8.2, published 9 July 2026.

**Which products and versions are affected?** Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0.

**Is there a fix for CVE-2026-44787?** A patch was published on 2026-06-30: Release tags for fixed versions created on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44787 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44787?** Check whether you run Discourse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper privilege management vulnerability (CWE-269) exists in the Discourse signup flow. The root cause is the ability for newly registering users to manipulate the 'primary_group_id' parameter during the account creation process. On sites where 'whispers_allowed_groups' is configured, an attacker can assign themselves to a privileged group, thereby gaining access to "whisper" (private staff-only) threads without legitimate authorization. This is a remote, unauthenticated attack vector requiring no user interaction. The issue has been patched in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

## Affected products

- Discourse Discourse < 2026.1.5, < 2026.4.2, < 2026.5.1, < 2026.6.0

## Timeline

- 2026-07-09: advisory: NVD publication date
- 2026-06-30: patched: Release tags for fixed versions created on GitHub

## References

- [https://github.com/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126](https://github.com/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126)
- [https://github.com/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8](https://github.com/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8)
- [https://github.com/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29](https://github.com/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29)
- [https://github.com/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a](https://github.com/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a)
- [https://github.com/discourse/discourse/releases/tag/v2026.1.5](https://github.com/discourse/discourse/releases/tag/v2026.1.5)
- [https://github.com/discourse/discourse/releases/tag/v2026.4.2](https://github.com/discourse/discourse/releases/tag/v2026.4.2)
- [https://github.com/discourse/discourse/releases/tag/v2026.5.1](https://github.com/discourse/discourse/releases/tag/v2026.5.1)

## Related threats

- [Discourse reflected cross-site scripting in email unsubscribe](https://junglewise.ai/threats/cve-2017-20290-discourse-1-9-0-beta2-before-1-9-0-beta13-contains-a-reflected)
- [Discourse oEmbed HTML injection in iframe allowlist](https://junglewise.ai/threats/cve-2026-91159-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse insufficient upload security metadata reconciliation](https://junglewise.ai/threats/cve-2026-91157-discourse-is-an-open-source-discussion-platform-prior-to-2026-9-0)
- [Discourse HTML injection in chat message excerpts](https://junglewise.ai/threats/cve-2026-91121-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)
- [Discourse HTML injection in lazy video embed notifications](https://junglewise.ai/threats/cve-2026-91120-discourse-is-an-open-source-discussion-platform-prior-to-2026-1-8)