CVE-2026-44783

Name of the Vulnerable Software and Affected Versions Discourse versions 2026.1.0-latest through 2026.1.3 Discourse versions 2026.3.0-latest through 2026.3.0 Discourse versions 2026.4.0-latest through 2026.4.0

Description A flaw in the handling of replies to whisper posts allows authenticated users who are not part of the groups defined in whispers allowed groups to post content into a topic's staff-only whisper channel. This injected content becomes visible to authorized whisperers, typically staff members, alongside legitimate messages. This issue only affects sites where the whisper feature is enabled.

Recommendations Update to version 2026.1.4 Update to version 2026.3.1 Update to version 2026.4.1