What is the CVSS score of CVE-2026-72722?

CVE-2026-72722 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-72722?

Yes, a patch is available for CVE-2026-72722. Update the affected software to the latest version immediately.

Discourse CVE-2026-72722

EUVD-2026-55659 MEDIUM

Missing Authorization (CWE-862)

2026-08-10 GitHub_M

Authentication Bypass Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via standard API, low complexity, authentication required (PR:L), confidentiality-only impact limited to metadata leakage; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 17:03 EUVD

Source Code Evidence Fetched

Aug 10, 2026 - 16:32 vuln.today

Analysis Generated

Aug 10, 2026 - 16:32 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

AnalysisAI

TopicLink authorization bypass in Discourse exposes restricted content metadata to authenticated users who lack permission to view those resources. All Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected. An authenticated user can craft internal links to private messages, restricted topics, or hidden posts and recover their canonicalized slugs or titles via the composer_messages duplicate_lookup API endpoint, even though those resources are not visible to them. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Discourse is a Ruby on Rails open-source discussion platform. The vulnerability resides in the TopicLink ActiveRecord model, specifically in three methods: extract_from, ensure_entry_for, and duplicate_lookup. These methods participate in Discourse's post-composing workflow, processing internal hyperlinks to detect duplicates and canonicalize URLs before a post is submitted. Discourse's authorization framework is built around the Guardian class, which exposes can_see? checks gating access to topics, private messages, and posts. The three affected methods bypass or inconsistently apply these checks when resolving internal links, meaning the duplicate_lookup response can leak topic titles and canonical slugs for resources the requesting user has no authorization to read. CWE-862 (Missing Authorization) precisely describes this root cause: a code path that retrieves sensitive data without first enforcing the authorization gate. The affected CPE is cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*, covering all versions prior to the patched releases.

RemediationAI

Upgrade Discourse to one of the patched versions: 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0, as documented in the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-4fx9-5m29-83p4. The fix was implemented across four pull requests (PRs #42091-#42094) and four corresponding commits, all enforcing consistent Guardian.can_see? checks within the TopicLink model. If an immediate upgrade is not possible, a compensating control is to restrict access to the composer_messages endpoint or disable the duplicate-link detection feature if the platform supports it; however, these workarounds may degrade user experience and their effectiveness is not confirmed by the vendor. Discourse instances with no restricted categories, private messages, or hidden posts face minimal practical risk from delaying the patch.