CVE-2026-91122Published
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91122 · Microsoft / collected KEV context
cve-program · CVE-2026-91122
- https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7
- https://github.com/discourse/discourse/pull/42882
- https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d
- https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031
- https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda
- https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.