CVE-2026-45788 json
Discourse: Secure uploads exposed by hotlinked image copying
published 2026-07-09 4 mo ago modified 2026-09-10 1 mo ago also BIT-discourse-2026-45788 , EUVD-2026-42731 , GHSA-3876-w96v-8v38
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.
Patch / fix
- bitnami discourse 2026.1.5, 2026.4.2, 2026.5.1
- discourse discourse 2026.1.5, 2026.4.2, 2026.5.1
- github.com/discourse/discourse@5807c42 commit
- github.com/discourse/discourse@8b4a959 commit
- github.com/discourse/discourse@eff53af commit
- github.com/discourse/discourse@fa74e0d commit
- github.com/discourse/discourse/releases/tag/v2026.1.5 release
- github.com/discourse/discourse/releases/tag/v2026.4.2 release
- github.com/discourse/discourse/releases/tag/v2026.5.1 release
- github.com/discourse/discourse/releases/tag/v2026.6.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | >=2026.1.0, <2026.1.5 >=2026.4.0, <2026.4.2 >=2026.5.0, <2026.5.1 |
2026.1.5 2026.4.2 2026.5.1 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
github.com
/discourse/discourse/commit/5807c426880eadf248006e851604fc9284327ce5
patch
-
github.com
/discourse/discourse/commit/8b4a959b251a856a9c911fb9f2ac34fbc31a7471
patch
-
github.com
/discourse/discourse/commit/eff53af26367ae0dcb3a426954d233e8c7449f95
patch
-
github.com
/discourse/discourse/commit/fa74e0dec7341a858ab83a1977fa52629bced1aa
patch
-
github.com
/discourse/discourse/security/advisories/GHSA-3876-w96v-8v38
vendor-advisory, advisory
-
github.com
/discourse/discourse/releases/tag/v2026.1.5
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.4.2
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.5.1
release-notes, article
-
github.com
/discourse/discourse/releases/tag/v2026.6.0
release-notes, article
-
nvd.nist.gov
/vuln/detail/CVE-2026-45788
web
Sources
- CVE List CVE-2026-45788
- NVD CVE-2026-45788
- OSV BIT-discourse-2026-45788
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.