CVE-2026-44779: Discourse Information Disclosure Flaw

CVE-2026-44779 Overview

CVE-2026-44779 is an information disclosure vulnerability in Discourse, an open-source discussion platform. The flaw allows authenticated low-privilege users to retrieve whisper translation audit logs through bot debug endpoints. Affected releases include versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1. The issue is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Discourse has patched the issue in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Critical Impact
Authenticated attackers with low privileges can access whisper translation audit logs intended for staff-only visibility, exposing confidential moderator discussions and translated content.

Affected Products

Discourse versions 2026.1.0-latest through 2026.1.3
Discourse versions 2026.3.0-latest through 2026.3.0
Discourse versions 2026.4.0-latest through 2026.4.0

Discovery Timeline

2026-06-12 - CVE-2026-44779 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-44779

Vulnerability Analysis

The vulnerability resides in Discourse bot debug endpoints that expose whisper translation audit logs without enforcing proper authorization. Whispers in Discourse are private staff-only messages visible to moderators and administrators. Translation audit logs record the original whisper content alongside its translated output, which preserves sensitive moderator communication. The bot debug endpoint returns these audit entries to any authenticated user who can issue the request, bypassing the staff-only visibility model.

The vulnerability is exploitable over the network and requires only low-privileged authentication. No user interaction is needed. The impact is limited to confidentiality, as the endpoint allows reading audit data but does not enable modification or service disruption.

Root Cause

The root cause is a missing or insufficient authorization check on the bot debug endpoints. The endpoints return whisper-related audit data without validating whether the requesting user holds staff-level privileges. This violates the principle of least privilege and falls under [CWE-200].

Attack Vector

An attacker with a valid low-privilege Discourse account sends an HTTP request to the affected bot debug endpoint. The server responds with whisper translation audit log entries that should be restricted to staff. The attacker can enumerate these entries to harvest confidential moderator dialogue and any translated content captured by the audit subsystem. The vulnerability mechanism is described in the Discourse GitHub Security Advisory GHSA-x6mr-wjq6-495j.

Detection Methods for CVE-2026-44779

Indicators of Compromise

Unexpected HTTP requests from non-staff user accounts targeting Discourse bot debug endpoints.
Spikes in low-privilege user requests returning whisper or translation audit log responses.
Access log entries showing repeated enumeration of debug endpoint paths by the same authenticated session.

Detection Strategies

Audit Discourse application logs for requests to bot debug endpoints originating from accounts without staff roles.
Correlate web server access logs with Discourse user role assignments to surface unauthorized debug endpoint access.
Establish a baseline of normal debug endpoint usage and alert on deviations from staff-only access patterns.

Monitoring Recommendations

Forward Discourse application and reverse-proxy logs to a centralized SIEM for continuous review.
Monitor for HTTP 200 responses on debug endpoints paired with non-staff session identifiers.
Track outbound data volume from debug endpoints to identify bulk extraction attempts.

How to Mitigate CVE-2026-44779

Immediate Actions Required

Upgrade Discourse to 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on the deployed branch.
Review recent access logs for bot debug endpoint requests from non-staff accounts and investigate suspicious activity.
Rotate any sensitive content that may have been disclosed through whisper translation audit logs.

Patch Information

Discourse has released fixed versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. Administrators should follow upgrade guidance in the Discourse Security Advisory GHSA-x6mr-wjq6-495j. Applying the patch is the only complete remediation, since the vulnerability stems from missing server-side authorization.

Workarounds

Restrict access to bot debug endpoints at the reverse proxy or web application firewall layer until the patch is applied.
Temporarily disable bot integrations that expose debug endpoints if immediate upgrade is not possible.
Limit account creation and enforce stricter trust-level requirements to reduce the population of users capable of authenticating against the endpoint.

bash

# Example nginx configuration to block access to Discourse bot debug endpoints
location ~* /admin/plugins/.*/bot/debug {
    deny all;
    return 403;
}