CVE-2026-44786CWE-200

Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users

High · published June 12, 2026

CVSS v3.1

7.5

EPSS

Percentile

35.3

In the wild

Unconfirmed

What it is

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, chat events for public category channels are published to MessageBus without permission scoping, so any MessageBus subscriber without chat enabled could receive chat message payloads in real time. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00420 · 35.3th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-06-12T20:22Z

EPSS history

Timeline

12 JUN 20:22Z
Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users
cvelistv5