CVE-2026-91157 in Discourse
Summary
by MITRE • 10/14/2026
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
Discourse is a widely deployed open-source discussion platform that relies on granular permission settings to control access to content within its various categories. A significant security flaw was identified in versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 regarding the handling of upload metadata when category permissions are modified. Specifically, the system failed to reconcile existing upload security attributes during transitions where a previously public category was changed to read-restricted or subjected to permission changes via bulk import operations. This oversight resulted in media files and attachments that were uploaded while the category remained publicly accessible retaining their original public accessibility flags even after the category's access level was restricted.
The technical root cause of this vulnerability lies in the failure of the application logic to update or invalidate the metadata associated with existing uploads when the scope of allowed viewership changes. When a user uploads media, Discourse assigns specific security attributes that dictate who can view the file. In scenarios where an administrator restricts access to a category after files have already been uploaded, these pre-existing upload records were not scrubbed or updated to reflect the new restrictive permissions. Consequently, the short URLs generated for these uploads continued to point directly to the resource without enforcing the newly applied read restrictions on the attachment level itself.
This architectural flaw leads to an Information Disclosure vulnerability where sensitive media and attachments remain reachable by anonymous users who should not have access under the current category settings. The impact is particularly severe because it affects files associated with deleted topics as well, meaning that even if a post containing private information or confidential documents is removed from view, the underlying file remains accessible via its direct URL. This bypasses the intended security model of secure uploads and allows unauthorized parties to retrieve data that was meant to be confined within specific user groups or restricted categories.
From an industry standard perspective, this vulnerability aligns with CWE-200: Information Exposure, as it involves the unintended disclosure of information through improper access controls. It also relates to CWE-653: Insufficient Compartmentalization because the security boundary between public and private content was not properly enforced at the resource level despite changes in logical group permissions. In terms of the MITRE ATT&CK framework, this behavior facilitates Information Collection via Direct Network Access or Exfiltration over Unencrypted Channels if an attacker were to systematically harvest these accessible files for further analysis or misuse.
To mitigate this risk, administrators must upgrade their Discourse instances to version 2026.9.0, 2026.8.1, 2026.7.3, or 2026.1.9 immediately upon availability. These versions contain the necessary patches to ensure that upload security metadata is correctly reconciled during category permission changes and bulk imports. Until an upgrade can be performed, administrators should manually review uploads in categories that have recently undergone permission restrictions and consider revoking access or re-uploading critical files if possible. Additionally, implementing strict monitoring for unusual download patterns of attachment URLs may help detect potential exploitation attempts while the system remains vulnerable.