Discourse Doc Categories CVE-2026-57447

The attacker must be a user who already holds edit rights on the Doc Categories index topic within a Discourse instance running the discourse-doc-categories plugin, and must reference target topics (private messages or topics in read-restricted categories) by link/ID inside that index. The flaw triggers on the doc category index structure refresh, which resolves linked titles without enforcing the viewer's authorization. Limiting factors: requires the discourse-doc-categories plugin to be installed and in use (non-default for most Discourse sites); requires the privileged index-edit capability rather than any anonymous access; and the disclosure is confined to topic titles, not post contents, so it cannot be used to read restricted message bodies.

This is a low-to-moderate priority information-disclosure issue, not an urgent one. The input CVSS (4.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and my independent assessment agree: network-reachable, low complexity, but requiring an authenticated user (PR:L) who already has edit rights on the documentation index topic - a meaningful trust prerequisite that narrows the attacker population to privileged content editors. The impact is limited to leaking topic TITLES of private messages and read-restricted categories; the advisory explicitly states it does NOT establish access to topic contents, so this is C:L with no integrity or availability effect. No EPSS score was supplied in the input, there is no CISA KEV listing, and no public exploit was provided - so exploitation signals are absent rather than alarming. SSVC-style reading: exploitation = none observed, automatable = no (requires a privileged editor and only yields metadata), technical impact = partial. Net: a genuine but minor confidentiality leak best scheduled with routine patching, not an emergency. Note one conflict to verify: CVSS marks AV:N/PR:L implying any low-privileged network user, but the actual precondition is the narrower 'can edit the index topic' capability - verify against Discourse's editor/trust-level configuration.

A user with permission to edit a Discourse documentation index topic adds links referencing private-message or restricted-category topic IDs/URLs. When the doc category index refreshes, it resolves and renders the real titles of those topics in the sidebar, revealing names the editor is not authorized to see. No public proof-of-concept was provided; exploitation requires only the authenticated edit capability and no victim interaction.