CVE-2026-91133

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0

Description Authenticated users can provide unescaped SQL LIKE metacharacters to upload-resolution patterns. This allows wildcard input to select unrelated upload records instead of matching a literal identifier. Consequently, the upload metadata, URL-lookup, and cooked-video-placeholder paths may resolve uploads that the user is not authorized to access, leading to the disclosure of restricted metadata such as original filenames and secure-upload paths.

Recommendations Update to version 2026.1.8 Update to version 2026.6.3 Update to version 2026.7.2 Update to version 2026.8.0