Discourse Information Leak and Missing Auth

Missing authorization in Discourse's FormTemplatesController exposes form template names and structured YAML content from restricted categories to any authenticated user, regardless of their category permissions. All active release tracks prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 are affected when the form templates feature is enabled. Impact is bounded to site configuration metadata disclosure - no post content, credentials, or user data are reachable - and no public exploit or CISA KEV listing exists, consistent with the EPSS score of 0.04% at the 12th percentile.

Discourse's AI summarization feature exposes removed or restricted content to anonymous and unprivileged users through stale cached summaries. Affected are all Discourse instances running versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 with AI summarization enabled. An unauthenticated attacker can read cached summaries that persist after the underlying content has been moderated or deleted, bypassing content removal controls. No public exploit code exists and no KEV listing has been issued at time of analysis.