CVE-2026-44783

5.4 Moyenne

Publiée le 12/06/2026 à 23:16 · Modifiée le 17/06/2026 à 20:55 · Analysée par le NVD · Source : security-advisories@github.com

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, a flaw in how replies to whisper posts are handled allows authenticated users outside the groups configured in whispers_allowed_groups to post into a topic's staff-only whisper channel. The injected content is visible to whisperers (typically staff) alongside legitimate whispers. Only sites that have whispers enabled are affected. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-284

Références

https://github.com/discourse/discourse/security/advisories/GHSA-98ch-mgfj-wqpw Third Party Advisory

CVE-2026-44783

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs