Discourse CVE-2026-91157

Requires the site-level 'secure uploads' setting to be enabled while 'secure_uploads_pm_only' is off (a non-default configuration), and requires a triggering event: a category changing from public to read-restricted, a category permission change, or category restriction applied during a bulk import. Only uploads that were posted while the category was public are affected (including those in deleted topics); exposure is via their short upload URLs, so an attacker must know or be able to enumerate those URLs. Limiting factors: the bug does not expose content that was private from creation, does not grant write/integrity impact, and does not apply to instances that never enabled secure uploads - substantially narrowing the real-world exposed population below what the 7.5 score suggests.

The input provides a CVSS 3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5), indicating remote, unauthenticated, low-complexity confidentiality disclosure. However, the description reveals the AC:L rating is questionable: exploitation is not against a default state but depends on a specific sequence - secure uploads must be enabled (a non-default hardening feature), AND a category must transition from public to read-restricted (or have permissions changed during a bulk import), AND the attacker must know or possess the 'short upload URL' for the affected media. This makes the attack opportunistic and dependent on conditions outside the attacker's control, so real-world complexity is higher than AC:L implies. No EPSS score, KEV listing, or POC was supplied: exploitation status is no public exploit identified at time of analysis. There is no SSVC decision data. The signals are therefore mild and partly conflicting - the 7.5 'High' rating overstates practical risk because the vulnerability is a passive residual-exposure bug (stale public accessibility flags) rather than an actively triggerable breach; the attacker gains nothing new to exploit, only continued anonymous reachability of content that was supposed to become private. Net priority: moderate - patch promptly on affected Discourse instances that use secure uploads, but this is not a drop-everything emergency absent evidence of exploitation.

A Discourse forum with secure uploads enabled makes a previously public category read-restricted (or restricts categories during a bulk migration). Attachments and images uploaded while the category was public - including those in since-deleted topics - keep their stale 'public' security flag, so an anonymous user who retained or can enumerate the short upload URL continues to download the now-supposedly-private files. No public exploit code is identified; the attack simply reuses previously known upload URLs.