‹ Back to list

CVE-2026-91157

Status: DeferredHigh (7.5)—
Severity7.5High · CVSS 3.1
Exploitation probability0.48 %higher than 40% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.

CVSS

Base score
7.5
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
0.48 %
Percentile among all scored CVEs
40
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

El vector AV:N/PR:N/UI:N y la descripción indican que usuarios anónimos acceden a adjuntos públicos vía URLs cortas tras un cambio de permisos, lo que sugiere lectura de datos.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Discourse — DiscourseAI

CWEs

References

Show 5 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-91157",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-91157",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-20T01:35:15.783931Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "discourse",
          "product": "discourse",
          "versions": [
            {
              "status": "affected",
              "version": "< 2026.1.9"
            },
            {
              "status": "affected",
              "version": ">= 2026.7.0-latest, < 2026.7.3"
            },
            {
              "status": "affected",
              "version": ">= 2026.8.0-latest, < 2026.8.1"
            },
            {
              "status": "affected",
              "version": ">= 2026.9.0-latest, < 2026.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-14T16:17:56.460",
  "references": [
    {
      "url": "https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9."
    }
  ],
  "lastModified": "2026-10-20T02:17:13.223",
  "sourceIdentifier": "security-advisories@github.com"
}