CVE-2026-91157
Discourse: Media uploads remain publicly accessible after category permissions are restricted
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
| CWE | CWE-200 CWE-863 |
| Vendor | discourse |
| Product | discourse |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for discourse discourse
Be the first to know when new high vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
discourse / discourse
< 2026.1.9 >= 2026.7.0-latest, < 2026.7.3 >= 2026.8.0-latest, < 2026.8.1 >= 2026.9.0-latest, < 2026.9.0
References
github.com: https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3 github.com: https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab github.com: https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708 github.com: https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7 github.com: https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458