Is there a patch available for CVE-2026-45788?

Yes, a patch is available for CVE-2026-45788. Update the affected software to the latest version immediately.

Discourse CVE-2026-45788

Q: What is the CVSS score of CVE-2026-45788?

CVE-2026-45788 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-42731 MEDIUM

Information Exposure (CWE-200)

2026-07-09 security-advisories@github.com

Information Disclosure Discourse

6.3

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

Network vector with high complexity due to prerequisite URL knowledge; no authentication required per PR:N; limited confidentiality impact with no integrity or availability consequences.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 23:02 EUVD

Analysis Generated

Jul 09, 2026 - 22:41 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, secure uploads could be exposed by pull_hotlinked_images when an attacker knew the secured upload URL and the secure_uploads site setting was enabled. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5.

AnalysisAI

Secure upload bypass in Discourse exposes protected files through the pull_hotlinked_images feature, which fails to enforce the secure_uploads access control when processing posts containing a known secure URL. Affected instances are those running versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5 with the secure_uploads site setting enabled. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV; however, the fix commits are publicly visible on GitHub, potentially aiding reverse-engineering of the flaw.

Technical ContextAI

Discourse is an open-source Ruby on Rails discussion platform that offers a secure_uploads site setting designed to restrict direct URL-based access to uploaded files, typically serving them through authenticated, time-limited signed URLs. The pull_hotlinked_images background job is a content-hygiene feature that re-hosts external images referenced in posts to the local Discourse storage, preventing hotlinking and preserving image availability. The vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) arises because this job fetches URLs without properly enforcing the access control layer applied by secure_uploads, meaning a secure upload URL embedded in a post can be fetched and its content exposed by the job outside of the normal authorization flow. No CPE string was provided in the input, but the affected software is identifiable as the Discourse application across multiple tracked stable branches (v2026.1.x, v2026.4.x, v2026.5.x, v2026.6.x).

RemediationAI

The primary fix is to upgrade Discourse to one of the patched releases: v2026.6.0, v2026.5.1, v2026.4.2, or v2026.1.5, all available as tagged GitHub releases (https://github.com/discourse/discourse/releases/tag/v2026.6.0, v2026.5.1, v2026.4.2, v2026.1.5). Four upstream commits address the issue (5807c426880eadf248006e851604fc9284327ce5, 8b4a959b251a856a9c911fb9f2ac34fbc31a7471, eff53af26367ae0dcb3a426954d233e8c7449f95, fa74e0dec7341a858ab83a1977fa52629bced1aa). If immediate upgrade is not possible, a compensating control is to disable the secure_uploads site setting (Admin > Settings), though this removes the upload access-control feature entirely and should be treated as a temporary measure only. Alternatively, administrators can audit and rotate any secure upload URLs that may have been exposed to untrusted parties, reducing the attack surface without disabling the feature. Disabling the pull_hotlinked_images job is theoretically a scoped mitigation but may affect content fidelity and is not officially recommended.