CVE-2026-45085: Discourse Information Disclosure Flaw

CVE-2026-45085 Overview

CVE-2026-45085 affects Discourse, an open-source discussion platform widely deployed for community forums. The vulnerability comprises four distinct authorization and information disclosure flaws in the chat plugin, with one issue also involving the discourse-calendar plugin. Affected versions include 2026.1.0-latest before 2026.1.4, 2026.3.0-latest before 2026.3.1, and 2026.4.0-latest before 2026.4.1. The issues allow read-only users to create chat threads, permit restoration of self-deleted messages after access revocation, expose unrelated direct message content to moderators reviewing flags, and leak chat channel contents through calendar event payloads to unauthorized viewers, including anonymous users.

Critical Impact
Unauthenticated and unauthorized users can access confidential chat channel content, including direct messages, through calendar event payloads and moderator review interfaces.

Affected Products

Discourse versions 2026.1.0-latest through 2026.1.3
Discourse versions 2026.3.0-latest through 2026.3.0
Discourse versions 2026.4.0-latest through 2026.4.0

Discovery Timeline

2026-06-12 - CVE-2026-45085 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45085

Vulnerability Analysis

CVE-2026-45085 bundles four authorization and information disclosure defects categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Each defect breaks an access control assumption in the chat plugin, allowing data to cross trust boundaries that should isolate channel membership, message ownership, and read-only category permissions.

The first defect permits users with read-only category access to create chat threads. This violates the principle that read-only roles cannot generate new content. The second defect allows authors to restore their self-deleted chat messages even after channel access has been revoked, bypassing the access revocation control.

The third defect surfaces during flagged message review. Moderators reviewing a flagged chat message are shown the channel's current last_message, which frequently contains unrelated direct message content from conversations the moderator has no permission to read. The fourth defect involves the discourse-calendar plugin: calendar event payloads embed the attached chat channel and its most recent message, exposing that content to any viewer of the calendar event, including anonymous users without chat access.

Root Cause

The root cause is inconsistent enforcement of authorization checks between the chat plugin's content creation paths, deletion lifecycle, moderation review interface, and cross-plugin payload serialization. Authorization is checked at the channel level but not consistently propagated to derived data such as last_message previews or calendar event metadata.

Attack Vector

Exploitation requires network access to the affected Discourse instance with the chat plugin enabled. The calendar-related disclosure additionally requires the discourse-calendar plugin. No authentication is required for the calendar event payload disclosure, as anonymous calendar viewers can extract the attached chat channel's last message. The other defects require an authenticated session with the relevant role.

No public exploit code or proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.191%.

The vulnerability manifests through normal plugin API interactions rather than crafted payloads. Refer to the GitHub Security Advisory GHSA-rw8j-p2gv-q33w for technical details from the maintainers.

Detection Methods for CVE-2026-45085

Indicators of Compromise

Unexpected chat thread creation events originating from accounts assigned to read-only categories.
Restoration of previously deleted chat messages by users whose channel access has been revoked.
Anonymous or unauthenticated HTTP requests to calendar event endpoints returning chat channel content in the JSON payload.
Moderator review actions on flagged chat messages where displayed content does not match the original flagged message.

Detection Strategies

Audit Discourse application logs for chat thread creation API calls correlated with user roles to identify read-only users creating threads.
Inspect calendar event API responses for embedded chat_channel or last_message fields exposed to unauthenticated sessions.
Review the flag and moderation queue audit trail for last_message field accesses that reference channels outside the flagged message scope.

Monitoring Recommendations

Enable verbose logging on the chat plugin and discourse-calendar plugin endpoints to capture authorization decisions.
Forward Discourse application and reverse-proxy logs to a centralized log platform and alert on anonymous calendar event requests returning chat payloads.
Track plugin version inventory across Discourse deployments to confirm patched releases are installed.

How to Mitigate CVE-2026-45085

Immediate Actions Required

Upgrade Discourse to version 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on the deployed release branch.
Confirm the discourse-calendar plugin is updated in tandem if it is enabled on the instance.
Review chat channel access logs and moderation queue history for evidence of disclosed direct message content.

Patch Information

Discourse has released patched versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1. The fixes correct authorization checks on chat thread creation, prevent message restoration after access revocation, scope the last_message field shown during flag review, and remove chat channel content from calendar event payloads served to unauthorized viewers. Patch references are documented in the GitHub Security Advisory GHSA-rw8j-p2gv-q33w.

Workarounds

Disable the chat plugin on affected Discourse instances until patches can be applied.
Disable the discourse-calendar plugin or remove chat channel attachments from calendar events to block the anonymous disclosure vector.
Restrict moderator review of flagged chat messages until the patched version is deployed.

bash

# Configuration example: verify Discourse version after upgrade
cd /var/discourse
./launcher rebuild app
docker exec -it app rails runner "puts Discourse::VERSION::STRING"