CVE-2026-91157

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.9.0 Discourse versions prior to 2026.8.1 Discourse versions prior to 2026.7.3 Discourse versions prior to 2026.1.9

Description Sites with secure uploads enabled fail to reconcile upload security metadata when a public category becomes read-restricted or when category permissions change during a bulk import. Consequently, media and attachments uploaded while the category was public retain a public accessibility flag, allowing anonymous users to access them via short upload URLs, even if the associated topics were deleted.

Recommendations Update to version 2026.9.0 Update to version 2026.8.1 Update to version 2026.7.3 Update to version 2026.1.9