Summary
CVE-2026-44787 is a high-severity privilege escalation vulnerability in Discourse, the open-source community discussion platform, affecting all versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. During the public account registration (signup) flow, a newly registering user can supply a crafted primary_group_id parameter to assign themselves membership in a whisper-enabled group, bypassing legitimate group enrollment entirely. On instances where the whispers_allowed_groups site setting is configured, this grants the unauthenticated attacker read and write access to whisper posts — private, restricted-visibility messages typically reserved for staff or privileged community members.
Technical details
- Root cause: Improper privilege management (CWE-269) in the Discourse registration handler — the signup endpoint fails to validate or sanitize the
primary_group_idparameter supplied by the registering user, allowing arbitrary group assignment at account creation time. - Trigger conditions: The
whispers_allowed_groupssite setting must be configured on the target instance; this is a non-default but common configuration used by enterprise and moderated community deployments. - Attack vector: Network-accessible with no prior authentication and no user interaction required — exploitation occurs entirely within the public account registration flow.
- Impact — Confidentiality (High): The attacker gains unauthorized read access to whisper posts, which are private in-topic messages visible only to members of designated staff or privileged groups, potentially exposing sensitive internal discussions, moderation deliberations, or confidential community communications.
- Impact — Integrity (Low): The attacker can also post whisper replies as though they are a legitimate whisper-group member, introducing the risk of content injection into restricted conversations.
- No public proof-of-concept exploit has been observed as of the publication date (2026-07-09).
Affected software
- Discourse >= 2026.1.0, < 2026.1.5
- Discourse >= 2026.4.0, < 2026.4.2
- Discourse >= 2026.5.0, < 2026.5.1
- Discourse < 2026.6.0 (all earlier release lines)
Severity
CVSS v3.1 Base Score: 8.2 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Mitigation and recommended actions
- Immediate — Apply vendor patches: Upgrade to one of the following fixed releases as appropriate for your release track:
- 2026.6.0
- 2026.5.1
- 2026.4.2
- 2026.1.5
- Interim workaround (if patching is not immediately possible): Clear the
whispers_allowed_groupssite setting in the Discourse admin panel to disable the whisper feature entirely. This removes the attack surface until the patch can be applied. Note that this will disable whisper functionality for all legitimate users as well.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.