Discourse Doc Categories
Monthly
Topic-title disclosure in the Discourse Doc Categories plugin lets an authenticated user who holds edit rights on a documentation index topic learn the titles of private messages and topics in read-restricted categories that the user is not authorized to view. The index refresh routine resolves linked topic titles without enforcing viewer authorization, so the leaked titles appear in the generated index structure even though the underlying topic contents remain inaccessible. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no confirmed active exploitation; the issue is largely confined to non-default Discourse instances that have this plugin installed and actively used, and the fix is a targeted authorization filter in the upstream commit b15d4de02ad29d7c9525346afee51fef4a2c605a.
Topic-title disclosure in the Discourse Doc Categories plugin lets an authenticated user who holds edit rights on a documentation index topic learn the titles of private messages and topics in read-restricted categories that the user is not authorized to view. The index refresh routine resolves linked topic titles without enforcing viewer authorization, so the leaked titles appear in the generated index structure even though the underlying topic contents remain inaccessible. Rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with no public exploit identified at time of analysis and no confirmed active exploitation; the issue is largely confined to non-default Discourse instances that have this plugin installed and actively used, and the fix is a targeted authorization filter in the upstream commit b15d4de02ad29d7c9525346afee51fef4a2c605a.