CVE-2026-91133
Deferred Deferred - Pending Action

SQL Injection in Discourse via LIKE Metacharacters

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-10-15
AI Q&A
2026-09-24
EPSS Evaluated
2026-10-13
NVD
CVE-2026-91133
EUVD
EUVD-2026-86299

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
discourse discourse to 2026.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Discourse allows authenticated users to manipulate SQL LIKE patterns in upload-resolution queries. By using metacharacters like % or _, attackers can bypass access controls and retrieve metadata or files they are not authorized to access. The issue affects upload metadata, URL lookups, and video placeholders, enabling unauthorized disclosure of restricted information such as filenames and secure paths.

Detection Guidance

This vulnerability involves SQL LIKE metacharacter injection in upload-resolution patterns. To detect it, inspect Discourse logs for unusual upload resolution queries containing wildcards like % or _. Check for unauthorized access attempts to upload metadata or secure paths. No specific commands are provided in the context.

Impact Analysis

If you use Discourse versions before 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0, attackers with valid credentials could access sensitive upload data they shouldn't see. This includes filenames and secure paths, potentially leading to data leaks or further exploitation. The impact is limited to unauthorized information disclosure without altering data.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by enabling unauthorized access to sensitive data. GDPR mandates strict data access controls, while HIPAA requires protection of health-related uploads. The flaw risks exposing restricted metadata, potentially leading to regulatory penalties or breaches of confidentiality.

Mitigation Strategies

Upgrade Discourse to versions 2026.1.8, 2026.6.3, 2026.7.2, or 2026.8.0 or later to patch the vulnerability. Review and restrict user permissions to prevent unauthorized access to upload metadata and secure paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91133. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart