CVE-2026-72722 in Discourse
Summary
by MITRE • 08/10/2026
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability affects Discourse, an open-source discussion platform, where multiple versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 contain a critical authorization flaw in the TopicLink module. The vulnerability stems from inconsistent enforcement of access control checks through the Guardian.can_see? method when processing internal links within the platform's core functionality.
The technical flaw manifests in three specific methods: TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup. These methods fail to properly validate user permissions before processing internal links, creating an authorization bypass condition that allows authenticated users to access content they should not be able to see. When a user submits links to restricted topics, private messages, or hidden posts, the system returns canonicalized slugs or titles in the composer_messages duplicate_lookup response, effectively leaking information about content that is normally hidden from the user.
This vulnerability represents a classic case of insufficient authorization checking, which aligns with CWE-285: "Improper Authorization" and falls under the ATT&CK technique T1078.1.1: "Valid Accounts: Default Accounts" as it exploits the legitimate authentication of users to gain unauthorized access to restricted content. The flaw essentially allows information disclosure through a path that should be protected by access controls, enabling attackers to discover the existence and metadata of hidden content within the discussion platform.
The operational impact of this vulnerability is significant as it undermines the platform's content protection mechanisms and could lead to privacy violations or information leakage. An authenticated user who gains access to restricted content through this vulnerability can potentially discover sensitive topics, private messages, or hidden posts that they should not normally have visibility into. This creates a data exposure risk where unauthorized users can gather intelligence about the platform's content structure and identify potentially sensitive discussions or communications.
Organizations using Discourse should immediately implement mitigations including upgrading to the patched versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 as specified in the security advisory. Additionally, administrators should review access control configurations and implement monitoring for unusual link submission patterns that might indicate exploitation attempts. The vulnerability demonstrates the importance of consistent authorization enforcement throughout all application components, particularly in modules handling content references and metadata retrieval. Security teams should also consider implementing automated scanning for similar authorization bypass conditions in other platform components to prevent similar issues from occurring in the future.