CVE-2026-44787CWE-269

Discourse: Signup-time primary_group_id assignment grants whisperer access

High · published July 9, 2026

CVSS v3.1
8.2
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00669 · 51.4th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-07-09T22:03Z
EPSS history
Timeline
  • 09 JUL 22:03Z
    Discourse: Signup-time primary_group_id assignment grants whisperer access
    cvelistv5