PT-2026-56993 · Discourse · Discourse

Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-44787

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary group id and gain whisper-group privileges without legitimate group membership on sites with whispers allowed groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-44787

Affected Products

Discourse

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-44787 · Security Note
• https://github.com/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126 · Note
• https://github.com/discourse/discourse/releases/tag/v2026.6.0 · Note
• https://github.com/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8 · Note
• https://github.com/discourse/discourse/releases/tag/v2026.5.1 · Note
• https://github.com/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx · Note
• https://github.com/discourse/discourse/releases/tag/v2026.4.2 · Note
• https://github.com/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a · Note
• https://github.com/discourse/discourse/releases/tag/v2026.1.5 · Note
• https://github.com/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29 · Note