CVE-2026-44782

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0 through 2026.1.3 Discourse versions 2026.3.0 Discourse versions 2026.4.0

Description An issue exists in the GroupPostSerializer where the predicate for the :name attribute was incorrectly declared as include user long name? instead of include name?. Because the Active Model Serializer (AMS) looks for include name?, the misnamed predicate was never executed. Consequently, object.user.name was always serialized, leading to the leakage of hidden full names regardless of the SiteSetting.enable names configuration.

Recommendations Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1