CVE-2026-44787 json
Discourse: Signup-time primary_group_id assignment grants whisperer access
published 2026-07-09 4 mo ago modified 2026-09-08 2 mo ago also BIT-discourse-2026-44787 , EUVD-2026-42735 , GHSA-vmwq-jvxx-jwfx
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Patch / fix
- bitnami discourse 2026.1.5, 2026.4.2, 2026.5.1
- discourse discourse 2026.1.5, 2026.4.2, 2026.5.1
- github.com/discourse/discourse@012796a commit
- github.com/discourse/discourse@0f50a07 commit
- github.com/discourse/discourse@5418e30 commit
- github.com/discourse/discourse@6fc7e6c commit
- github.com/discourse/discourse/releases/tag/v2026.1.5 release
- github.com/discourse/discourse/releases/tag/v2026.4.2 release
- github.com/discourse/discourse/releases/tag/v2026.5.1 release
- github.com/discourse/discourse/releases/tag/v2026.6.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
| OSV | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | >=2026.1.0, <2026.1.5 >=2026.4.0, <2026.4.2 >=2026.5.0, <2026.5.1 |
2026.1.5 2026.4.2 2026.5.1 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-269 Improper Privilege Management
References
-
github.com
/discourse/discourse/commit/012796ac28c85b30aa233c5ef042fc66efff8126
patch
-
github.com
/discourse/discourse/commit/0f50a07a6ef4b33f3f826ce6d7bf6d7bd16912d8
patch
-
github.com
/discourse/discourse/commit/5418e3027dba109e27a4796463686d61e190ac29
patch
-
github.com
/discourse/discourse/commit/6fc7e6cf04422fc3f9d1c99134803071e983ff0a
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-vmwq-jvxx-jwfx
vendor-advisory, mitigation, advisory
-
github.com
/discourse/discourse/releases/tag/v2026.1.5
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.4.2
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.5.1
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.6.0
release-notes, article
-
nvd.nist.gov
/vuln/detail/CVE-2026-44787
web
Sources
- CVE List CVE-2026-44787
- NVD CVE-2026-44787
- OSV BIT-discourse-2026-44787
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.