CVE-2026-91156

7.5High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Authenticated users who can view a category can read live and backlog chat messages in restricted category channels even if chat access is blocked for their group. The attacker needs an active account with category read permissions.

Root cause

The MessageBus publication path checked category visibility permissions when broadcasting messages but failed to verify Chat group eligibility.

Affected systems

Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Discourse to 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 or later. If upgrading must wait, disable chat on restricted categories or restrict category view permissions to users who are also allowed to chat.

shell

$ cd /var/discourse && ./launcher rebuild app

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-91156