Discourse CVE-2026-45775

Exploitation requires three concurrent structural conditions: (1) the attacker must hold an active, valid administrator account on at least one site within the Discourse deployment - this is a high-privilege requirement confirmed by CVSS PR:H; (2) Discourse must be running in multisite mode, where two or more sites share a single application host and filesystem; and (3) Discourse must be configured to store backups locally on the server filesystem, not in a remote object store such as S3. Any deployment missing one of these three conditions - including all single-site Discourse installations globally - is not vulnerable. The CVSS AC:L rating reflects that once these structural conditions are present, no additional exploitation complexity (such as a race condition or specific timing) is required. Exploitation is limited to confidentiality impact only; the attacker cannot modify or delete Site B's data via this vector (I:N, A:N in the CVSS vector).

The CVSS 3.1 score of 6.8 is driven upward by the scope change (S:C) and high confidentiality impact (C:H), reflecting that exploitation crosses a site-isolation boundary to expose another system's sensitive data. However, the PR:H metric is the most operationally significant signal - the attacker must already hold an active administrator account on one of the co-hosted sites, which represents a high-trust position. EPSS of 0.04% at the 12th percentile is consistent with this narrow attack profile and suggests no broad or opportunistic exploitation activity at the time of analysis. There is no CISA KEV listing and no public exploit code has been identified. For the overwhelming majority of Discourse deployments - single-site installations or those using remote object storage - this vulnerability has zero applicability. Real-world risk is concentrated in organizations running multisite Discourse deployments with local backup storage where different site administrators are not fully mutually trusted, a relatively uncommon configuration. The CVSS vector accurately characterizes the technical severity of what an attacker can do once in position, but the prerequisite conditions substantially reduce the realistic threat population.

An attacker who has legitimately or illicitly obtained administrator credentials for Site A in a Discourse multisite deployment submits a crafted backup download request to the Discourse backup endpoint, embedding path traversal sequences such as '../../site_b_backup_dir/latest.tar.gz' in the filename parameter. The unpatched server resolves the traversal without restriction and streams Site B's backup archive - containing its full database dump, user accounts, private messages, and hashed or plaintext credentials - back to the attacker. No public exploit code has been identified, but exploitation requires only a standard HTTP client and knowledge of the target site's backup filename or directory structure.