CyberRota Analysis
AI-GeneratedThe vulnerability affects the Discourse open-source discussion platform, where certain functions do not consistently enforce visibility checks, allowing authenticated users to access canonicalized slugs or titles of restricted content. This could lead to unauthorized exposure of private messages or hidden posts, potentially compromising user privacy. Organizations using affected versions should prioritize updating to the fixed releases (2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0) to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.