A flaw in the reply handling of whisper posts allows authenticated users who are not members of the whisper‑allowed groups to create staff‑only whisper messages. The injected content is visible only to staff, effectively enabling non‑whisperers to impersonate staff or spread misinformation within the privileged channel. This weakness is an access control violation (CWE‑284).

The vulnerability affects the open‑source Discourse discussion platform. Versions 2026.1.0 through 2026.1.3, 2026.3.0 through 2026.3.0, and 2026.4.0 through 2026.4.0 are impacted. Only sites that have the whispers feature enabled are susceptible.

The CVSS score is 5.4, indicating a moderate impact, and the EPSS score is less than 1 %, suggesting a very low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers must be authenticated and have the ability to reply to a whisper post; the attack vector is therefore internal via legitimate user accounts. No external network attack vector is described and no serious impact on confidentiality or system integrity beyond the unauthorized posting of content to the whisper channel. The flaw permits a compromised or malicious ordinary user to inject staff‑level whispers, which could be used for social engineering or misinformation against staff or sensitive discussions.