CVE-2026-91156 Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
An authenticated user can view live chat messages from restricted categories via MessageBus despite lacking Chat permissions, exposing sensitive content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91156?
CVE-2026-91156 is a high-severity missing authorization vulnerability in discourse, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could view the category but was not allowed to use Chat under the site's group restrictions. The publication path bounded events by category visibility without also enforcing Chat eligibility, exposing live and recent message content available in the MessageBus backlog. The issue does not permit retrieval of the channel's full history through the Chat API and does not permit message creation or modification. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Weakness: CWE-862
Which versions are affected by CVE-2026-91156?
1 open source package ship an affected version, including discourse.
| Package | Affected | Fixed in |
|---|---|---|
discourse Bitnami | All versions | 2026.1.9, 2026.7.3, 2026.8.1, 2026.9.0 |
How do I fix CVE-2026-91156?
Upgrade discourse to a fixed version for your release line: 2026.1.9, 2026.7.3, 2026.8.1 or 2026.9.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91156 being exploited?
There is no known exploitation of CVE-2026-91156 in the wild and no public exploit code.
Sources
Also known as BIT-discourse-2026-91156, GHSA-gh4f-qr62-vx8q.