Improper access control in Discourse - CVE-2026-44782
Published: July 1, 2026
Vulnerability identifier: #VU136574
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-44782
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Civilized Discourse Construction Kit, Inc.
Affected software:
Discourse
Discourse
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in GroupPostSerializer when serializing reaction post associations. A remote user can access serialized post data to disclose sensitive information.
Hidden full names may be exposed even when the site setting intended to disable name display is enabled.
How to mitigate CVE-2026-44782
Install security update from vendor's website.