CVE-2026-91156 discourse CVE debrief

Who should care

Discourse administrators and users with Chat access should assess exposure and apply patches. Roles include site administrators, moderators, and users with group restrictions. Defenders should prioritize verifying exposure and applying patches due to potential unauthorized message access. Affected operators, platform administrators, and security teams should review vulnerability details and take necessary actions.

Why it matters

CVE-2026-91156 allows unauthorized users to access read-restricted messages in Discourse Chat. Defenders should verify exposure, apply patches, and review site restrictions.

• Potential unauthorized access to sensitive information in read-restricted messages.
• Need to verify exposure and apply patches to prevent unauthorized message access.
• Possible impact on user trust and site reputation if exploited.
• Requires review of site group restrictions and Chat eligibility settings.

Technical summary

The Discourse Chat MessageBus incorrectly calculated audience, allowing authenticated users to access read-restricted category chat messages without Chat eligibility. This issue exposes live and recent message content available in the MessageBus backlog but does not permit retrieval of the channel's full history, message creation, or modification. The vulnerability affects Discourse site administrators, moderators, and users with group restrictions, requiring review of site restrictions and Chat eligibility settings.

Defensive priority

Defenders should prioritize verifying exposure and applying patches due to potential unauthorized message access.

Recommended defensive actions

• Verify exposure by checking Discourse Chat usage and user group restrictions.
• Apply patches to versions 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9.
• Review site group restrictions and Chat eligibility settings.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The issue arises from incorrect audience calculation in MessageBus, allowing access to live and recent message content. The vulnerability does not permit full history retrieval or message creation/modification. Evidence is limited to supplied source corpus and CVE record details. Defenders should verify exposure by checking Discourse Chat usage and user group restrictions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.