PT-2026-56993 · Discourse · Discourse

Publicado 2026-07-09 · Atualizado 2026-07-09 · CVE-2026-44787

NVD

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary group id and gain whisper-group privileges without legitimate group membership on sites with whispers allowed groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-44787

Produtos afetados

Discourse

Referências · 10

• https://github.com/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 · Nota
• https://github.com/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8 · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 · Nota
• https://github.com/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44787 · Nota de Segurança
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 · Nota
• https://github.com/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a · Nota
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 · Nota
• https://github.com/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29 · Nota