CVE-2026-72722

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0

Description An authenticated user can obtain canonicalized slugs or titles of restricted topics, private messages, or hidden posts that they are not authorized to view. This occurs because the functions TopicLink.extract from(), TopicLink.ensure entry for(), and TopicLink.duplicate lookup() do not consistently enforce Guardian.can see? checks when processing internal links. The information is leaked through the composer messages duplicate lookup response.

Recommendations Update to version 2026.1.6 Update to version 2026.5.2 Update to version 2026.6.1 Update to version 2026.7.0