Discourse CVE-2026-72722

Exploitation requires an active authenticated session on the Discourse instance - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The attacker must be able to reach the composer_messages duplicate_lookup endpoint, which is standard for any registered user. The information leak only materializes when the Discourse instance hosts content in restricted categories, private messages, or hidden posts that the authenticated user is not authorized to view; instances with no such restricted content expose no meaningful information. No special configuration, plugin, or non-default feature is required beyond the default Discourse installation. The limiting factors for exploitation are: (1) authentication is mandatory, (2) the attacker must know or be able to guess internal topic URLs or IDs to target, and (3) the leak is limited to slugs and titles, not post body content.

The CVSS 3.1 base score of 4.3 (Medium) is consistent with the actual impact: the vulnerability is network-reachable, low-complexity, requires authentication (PR:L), and yields only partial confidentiality impact - specifically topic titles and URL slugs, not full post bodies, private message content, or credentials. No EPSS score was provided in the available intelligence data, so exploitation probability cannot be quantified numerically. The CVE is absent from the CISA KEV catalog and no public proof-of-concept code has been identified, which together suggest this remains theoretical or opportunistic rather than actively targeted. The realistic risk is most acute on Discourse instances that host sensitive or confidential discussions in restricted categories or private messages - common in enterprise, legal, healthcare, or government deployments. The CVSS signals and description are internally consistent: AV:N and AC:L confirm easy network reachability, PR:L confirms authentication is required, and C:L reflects the narrow scope of the leak. No conflicting signals were detected between the CVSS vector and the description. Overall, this is a genuine medium-severity issue warranting prompt patching on sensitive deployments, though it does not represent an emergency for public-facing community forums with no confidential content.

An authenticated Discourse user - such as a registered community member with no elevated privileges - pastes a link to a private message or restricted topic into the post composer. The composer's duplicate-detection feature fires a duplicate_lookup API request, and the server returns the title and canonical slug of the target resource in the response, even though that resource is not visible to the user. The attacker can enumerate restricted topic titles by systematically submitting candidate URLs. No public exploit code has been identified, but the attack requires only a standard authenticated browser session and knowledge of or ability to guess internal topic URLs.