CVE-2026-57447 PUBLISHED

Discourse Doc Categories: Doc category index refresh leaks private topic titles

Assigner: GitHub_M
Reserved: 24.06.2026 Published: 16.10.2026 Updated: 16.10.2026

Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use this behavior to learn titles that the user is not authorized to view, although the advisory does not establish access to topic contents. This vulnerability is addressed by commit b15d4de02ad29d7c9525346afee51fef4a2c605a.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Product Status

Vendor discourse
Product discourse-doc-categories
Versions
  • Version < b15d4de02ad29d7c9525346afee51fef4a2c605a is affected

References

Problem Types

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE