CyberRota Analysis
AI-GeneratedThe vulnerability in the Discourse platform allows newly registered users to manipulate the signup process to gain unauthorized whisper-group privileges, bypassing legitimate group membership requirements on sites with specific configurations. This could lead to unauthorized access to sensitive discussions and information. Organizations using affected versions should prioritize upgrading to the patched releases (2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5) to mitigate the risk of privilege escalation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow could allow newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)