Executive brief
Discourse is an open-source discussion and community platform. An authenticated user can exploit insufficient permission checks in the duplicate link detection feature to discover the titles and slugs of restricted topics, private messages, and hidden posts they should not have access to. This leaks sensitive information about private content, potentially revealing organizational structure or confidential discussions to users who should be blocked from viewing them.
Technical details
The vulnerability exists in TopicLink methods (extract_from, ensure_entry_for, and duplicate_lookup) that process internal links without consistently enforcing Guardian.can_see? permission checks. An authenticated attacker can submit links to restricted topics, private messages, or hidden posts in the composer and receive canonicalized slugs or titles in the duplicate_lookup response, even though the target content is not visible to the attacker. The attack requires authentication (user account) and network access to the Discourse instance, but no special privileges. The fix adds permission checks using Guardian.can_see? to prevent these methods from leaking metadata about restricted content.
Affected products
- Discourse Discourse Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0
Timeline
- 2026-08-10: disclosed