Discourse: Signup-time primary_group_id assignment grants whisperer access (CVE-2026-44787) | HOL Guard CVE