CVE-2026-91157

Deferred Deferred - Pending Action

Information Disclosure in Discourse Prior to 2026.9.0

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-91157

EUVD

EUVD-2026-101302

Affected Vendors & Products

Vendor	Product	Version / Range
discourse	discourse	< 2026.1.9
discourse	discourse	>= 2026.7.0-latest, < 2026.7.3
discourse	discourse	>= 2026.8.0-latest, < 2026.8.1
discourse	discourse	>= 2026.9.0-latest, < 2026.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Discourse allows media uploads to remain publicly accessible even after category permissions are restricted from public to read-only access. When secure uploads are enabled, previously public uploads retain their public flag despite category changes or bulk imports. Anonymous users can still access these uploads via short URLs, including content from deleted topics.

Detection Guidance

Check Discourse version with: bundle exec rake version. If version is below 2026.1.9, 2026.7.3, 2026.8.1, or 2026.9.0, the system is vulnerable. Review category permissions for any previously public categories now restricted. Inspect upload URLs for public access to restricted content. Use server logs to identify anonymous access to uploads via short URLs.

Impact Analysis

This vulnerability could lead to unauthorized access to sensitive or private content. Attackers might view restricted media or attachments through direct URLs, even if the category permissions were later changed to restrict access. This includes content from deleted topics that should no longer be accessible.

Compliance Impact

This vulnerability could lead to unauthorized public access to sensitive media and attachments, potentially violating confidentiality requirements under GDPR and HIPAA. If restricted content remains publicly accessible via short URLs, it may result in non-compliance with data protection regulations that mandate strict access controls for personal or health information.

Mitigation Strategies

Upgrade Discourse to patched versions 2026.1.9, 2026.7.3, 2026.8.1, or 2026.9.0. Re-upload affected media in restricted contexts. Delete vulnerable uploads from server storage. Remove uploads from soft-deleted topics. Run backfill jobs to secure existing uploads in restricted categories.

Hi! I’m here to help you understand CVE-2026-91157. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70