Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Published: 2026-07-09
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

During user signup, Discourse allows new accounts to specify a primary_group_id that can be set to any group ID, including the whisper group. This bypasses normal membership checks and grants whisper‑group privileges without legitimate authorization, constituting an improper authorization flaw as defined by CWE-269.

Affected Systems

The vulnerable version of the Discourse discussion platform is any release prior to 2026.6.0. Specifically, the bug affects 2026.5.1, 2026.4.2, and 2026.1.5, which can be identified by their release tags on the project’s GitHub releases page.

Risk and Exploitability

The CVSS score of 8.2 highlights a high severity impact. The EPSS score is under 1%, indicating a low but non‑zero likelihood of exploitation, and the issue is not yet listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, unauthenticated: an attacker can create a new account, set the primary_group_id to the whisperer group ID, and instantly gain privileged whisper access without any legitimate membership.

Generated by OpenCVE AI on July 28, 2026 at 08:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Discourse installation to version 2026.6.0 or any later fixed release, which contains the vendor‑supplied patch for this issue.
  • Verify and tighten the whisper_allowed_groups setting so that only authorized groups can receive whispers, reducing the risk of unauthorized privileged access.
  • Audit existing user accounts for improper primary_group_id assignments, particularly those who signed up without legitimate membership, and correct or revoke any unauthorized whisperer group access.
  • Continuously monitor account creation logs for unusual group assignment patterns and block any suspicious signup attempts.

Generated by OpenCVE AI on July 28, 2026 at 08:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
First Time appeared Discourse
Discourse discourse
Vendors & Products Discourse
Discourse discourse

Thu, 09 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Description Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Title Discourse: Signup-time primary_group_id assignment grants whisperer access
Weaknesses CWE-269
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Discourse Discourse
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-10T20:59:36.502Z

Reserved: 2026-05-07T19:20:44.691Z

Link: CVE-2026-44787

cve-icon Vulnrichment

Updated: 2026-07-10T20:53:16.411Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T08:45:04Z

Weaknesses
  • CWE-269

    Improper Privilege Management