CVE-2026-91156: Discourse Chat MessageBus Delivers Read-Restricted Messages to Unauthorized Users
Summary
CVE-2026-91156: Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users. Affects discourse across 4 version ranges.
< 2026.1.9
>= 2026.7.0, < 2026.7.3
>= 2026.8.0, < 2026.8.1
>= 2026.8.99, < 2026.9.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Discourse is an open-source discussion platform designed to facilitate online conversations and community engagement. It offers features such as threaded discussions, real-time notifications, and a robust chat system. However, prior to specific versions, it had a vulnerability in its MessageBus system that allowed unauthorized users to access messages from restricted chat channels.
Vulnerability Detail
The vulnerability arises from a flaw in the MessageBus audience calculation, which failed to enforce chat eligibility based on group restrictions. As a result, authenticated users who could view a category were able to receive messages from a read-restricted chat channel, exposing live and recent message content. This issue does not allow for the retrieval of the full message history or the ability to create or modify messages, but it does pose a significant privacy risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2026.1.92026.1.9 -
>= 2026.7.0, < 2026.7.32026.7.3 -
>= 2026.8.0, < 2026.8.12026.8.1 -
>= 2026.8.99, < 2026.9.02026.9.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the chat feature for users who should not have access to read-restricted categories until the update is applied.
Conclusion
The CVE-2026-91156 vulnerability in Discourse poses a serious risk by allowing unauthorized access to read-restricted chat messages. It is crucial for users to update to the latest versions to ensure the security of their discussions and user privacy.
See every vulnerability recorded for discourse →
FAQ
CVE-2026-91156 is a vulnerability in Discourse that allows unauthorized users to receive messages from read-restricted chat channels.
If your installation is affected, unauthorized users may gain access to sensitive chat messages, compromising user privacy.
Versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting chat access for users who should not have it until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for discourse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
