CVE-2026-91157High· 7.5▾ TwilightDiscourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-res…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-27481Medium· 5.3Discourse is an open-source discussion platform
CVE-2026-32618Medium· 4.3Discourse is an open-source discussion platform
CVE-2026-32143Medium· 6.5Discourse is an open-source discussion platform
CVE-2017-20290Medium· 6.1Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
CVE-2026-57447Medium· 4.3Discourse Doc Categories is a plugin for organizing Discourse topics as documentation
CVE-2026-55103High· 8.6Discourse ActivityPub adds ActivityPub support to Discourse