Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T16:19:49.520Z",
  "pubdate": "2026-08-10T16:19:49.520Z",
  "executiveSummary": "An access control enforcement vulnerability exists in Discourse prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The vulnerability involves improper authorization checks within internal link processing functions.\nAn authenticated attacker can exploit this flaw by submitting links targeting restricted topics, private messages, or hidden posts that they lack permissions to view.\nSuccessful exploitation results in the disclosure of sensitive metadata, specifically canonicalized slugs and titles returned within the composer_messages duplicate_lookup response, violating the confidentiality boundaries of restricted content.\nThe risk implication is unauthorized information disclosure of private discussion metadata to lower-privileged or standard authenticated users.\nExploitation requires an authenticated session and the ability to submit internal links to the application composer, allowing the retrieval of unauthorized data via standard application responses.",
  "technicalDetails": "The root cause of the vulnerability stems from the failure of internal link processing mechanisms to consistently enforce authorization checks via Guardian.can_see?.\nThe affected components comprise specific internal functions within the application codebase, namely TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup.\nAffected product versions include all Discourse installations prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.\nAuthentication is required to exploit this vulnerability, as the attack vector involves interacting with the composer interface and submitting crafted internal links.\nPrivilege requirements are minimal, requiring only standard authenticated user access to interact with the composer and trigger duplicate lookup queries.\nNetwork exposure is standard web application accessibility, where authenticated users can reach the application endpoints responsible for message composition and link extraction.\nThe attack flow proceeds as follows: First, an authenticated user constructs a payload containing internal links pointing to restricted resources, such as private messages, hidden posts, or access-controlled topics that are normally prohibited by the user's privilege level. Second, the user submits these links into the application composer. Third, the vulnerable functionsTopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup process the input without validating the user's authorization against the target objects using Guardian.can_see?. Fourth, the application generates a composer_messages duplicate_lookup response containing sensitive details, such as canonicalized slugs and titles of the restricted targets. Finally, the attacker receives this response, thereby gaining unauthorized visibility into protected metadata.\nThe post-exploitation impact is limited to the unauthorized disclosure of resource titles and slugs, enabling reconnaissance against hidden or private discussions on the platform."
}