Medium severity4.3NVD Advisory· Published Jun 12, 2026· Updated Jun 15, 2026

CVE-2026-44785

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, the AI "explain" helper only checks can_see? on the post being explained, not its reply_to_post, so any authenticated user with access to the AI helper could read the raw contents of a hidden parent post by invoking "Explain" on a reply to it. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Discourse (software)/Discourseinferred2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <2026.1.4, <2026.3.1, <2026.4.1
osv-coords
pkg:bitnami/discourse
Range: >= 2026.1.0, < 2026.1.4

Patches

Vulnerability mechanics

References

github.com/discourse/discourse/security/advisories/GHSA-7h76-fwxc-j586nvd

News mentions

Discourse: 11 Bugs Patched in Coordinated June 12 Release, Including Chat MessageBus Authorization Flaw
Vypr Intelligence · Jun 12, 2026

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000