CVE-2026-44786: Discourse: Public chat MessageBus broadcasts are not restricted to chat-eligible users

Synopsis

An authorization bypass in Discourse's real-time messaging layer allows any authenticated or unauthenticated MessageBus subscriber to receive chat message payloads from public category channels without having chat access enabled. The flaw is reachable over the network with no credentials required, as described by the CVSS vector (AV:N/PR:N). Successful exploitation exposes the full content of real-time chat messages to any subscriber, resulting in unauthorized disclosure of conversation data. Patched-image rebuilds at versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable MessageBus endpoint is exposed over the network, so an attacker must be able to reach the Discourse service remotely.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, meaning any unauthenticated subscriber can receive the chat payloads.

• Victim interactionNot required

  Exploitation is passive; the attacker simply subscribes to the MessageBus channel and receives chat events without any action from a victim user.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special conditions, race timing, or environmental dependencies.

Blast Radius

• Reads the full plaintext content of real-time chat messages posted to public category channels, including any sensitive information shared in those conversations.
• Captures message metadata such as sender identity, timestamps, and channel context without any authorization check.
• Enables passive, continuous surveillance of ongoing chat activity for as long as the subscription is maintained.