CVE-2026-72722 json
Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
published 2026-08-10 2 mo ago modified 2026-09-08 2 mo ago also BIT-discourse-2026-72722 , EUVD-2026-55659 , GHSA-4fx9-5m29-83p4
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Patch / fix
- bitnami discourse 2026.1.6, 2026.5.2, 2026.6.1
- discourse discourse 2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0
- github.com/discourse/discourse@45abd92 commit
- github.com/discourse/discourse@7d7ce54 commit
- github.com/discourse/discourse@836a251 commit
- github.com/discourse/discourse@e54ba27 commit
- github.com/discourse/discourse#42091 pull request
- github.com/discourse/discourse#42092 pull request
- github.com/discourse/discourse#42093 pull request
- github.com/discourse/discourse#42094 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | discourse | <2026.1.6 >=2026.5.0, <2026.5.2 >=2026.6.0, <2026.6.1 |
2026.1.6 2026.5.2 2026.6.1 |
Affected products
- discourse discourse
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/discourse/discourse/pull/42091
web
-
github.com
/discourse/discourse/pull/42092
web
-
github.com
/discourse/discourse/pull/42093
web
-
github.com
/discourse/discourse/pull/42094
web
-
github.com
/discourse/discourse/commit/45abd925e46e8be40d2d047bced26628f26e4e31
web
-
github.com
/discourse/discourse/commit/7d7ce546ac86e24a6512b321ace69fc52fe37bf4
web
-
github.com
/discourse/discourse/commit/836a251d54a1004fb1c463a7d299b933b176191f
web
-
github.com
/discourse/discourse/commit/e54ba27eacee0f14f315e510e287e7ac2e4bdb1a
web
-
github.com
/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72722
web
Sources
- CVE List CVE-2026-72722
- NVD CVE-2026-72722
- OSV BIT-discourse-2026-72722
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.