CVE-2026-91157 discourse CVE debrief

Who should care

Discourse site administrators, security teams, and users with access to media uploads should assess exposure and apply patches to prevent unauthorized access. This includes reviewing category permissions, upload security metadata, and monitoring for unauthorized access to media and attachments through short upload URLs. Prioritization should be given to sites with secure uploads enabled, especially those with public categories or recent permission changes.

Why it matters

Defenders should prioritize verifying exposure and applying patches for Discourse sites with secure uploads enabled, especially those with public categories or recent permission changes. The vulnerability allows media and attachments to remain publicly accessible even after category permissions are restricted.

• Verify exposure of media uploads and apply patches to prevent unauthorized access
• Review category permissions and upload security metadata to ensure proper configuration
• Monitor for unauthorized access to media and attachments through short upload URLs

Technical summary

Discourse sites with secure uploads enabled did not reconcile existing upload security metadata when category permissions changed. This resulted in media and attachments uploaded while a category was public remaining publicly accessible through short upload URLs. The issue allows unauthorized users to access media and attachments associated with deleted topics, posing a significant risk to sites with public categories or recent permission changes. Defenders should prioritize verifying exposure and applying patches for Discourse sites with secure uploads enabled.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for Discourse sites with secure uploads enabled, especially those with public categories or recent permission changes.

Recommended defensive actions

• Verify Discourse site versions and apply patches to ensure secure uploads are properly configured
• Review category permissions and upload security metadata for potential exposure
• Monitor for unauthorized access to media and attachments through short upload URLs
• Perform a thorough review of existing media uploads and their accessibility
• Update incident response plans to include checks for this vulnerability
• Conduct a security audit to identify any exposed media uploads
• Implement additional monitoring for access to media and attachments

Evidence notes

The CVE record and source item provide details on the vulnerability and fixed versions. However, additional information on exploitation or victim impact is not available. Defenders should verify exposure and apply patches for Discourse sites with secure uploads enabled, especially those with public categories or recent permission changes. The lack of information on exploitation or victim impact makes it crucial to prioritize verification and patching based on the available details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.