CVE-2026-57447: Discourse Doc Categories Information Leak

CVE-2026-57447 Overview

CVE-2026-57447 is an information disclosure vulnerability in the Discourse Doc Categories plugin, which organizes Discourse topics as documentation. The flaw resides in the doc category index refresh routine, which resolves linked titles for private messages and restricted-category topics without enforcing the viewer's authorization. A user with permission to edit the index topic can leverage this behavior to learn titles of topics they are not authorized to view. The advisory does not establish that attackers can access topic contents through this issue. The maintainers addressed the vulnerability in commit b15d4de02ad29d7c9525346afee51fef4a2c605a.

Critical Impact
Authenticated users with index-edit rights can enumerate titles of private messages and restricted topics, leading to information exposure categorized under [CWE-200].

Affected Products

Discourse Doc Categories plugin (versions prior to the fix commit)
Discourse installations using the Doc Categories plugin for documentation workflows
Deployments exposing restricted categories or private messages alongside index topics

Discovery Timeline

2026-10-16 - CVE-2026-57447 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-57447

Vulnerability Analysis

The Discourse Doc Categories plugin builds documentation indexes by parsing links in a designated index topic and resolving each link to its target topic metadata. During this resolution, the plugin fetches topic records by identifier and returns their titles for rendering in the index. The server-side refresh path does not re-check whether the requesting user is authorized to view each resolved topic. As a result, a user who can edit the index topic can insert links pointing to private messages or topics in restricted categories and observe the resulting titles. This behavior constitutes an authorization boundary failure limited to topic titles rather than topic bodies.

Root Cause

The underlying defect is a missing authorization check in the index structure refresher service at app/services/doc_categories/index_structure_refresher.rb. Topic lookups executed through ::Topic.where(id: topic_ids) return records without considering the viewer's visibility scope. The fix updates the query to eager-load the associated category via .includes(:category), enabling downstream guard logic to evaluate category-level permissions when titles are rendered.

Attack Vector

Exploitation requires an authenticated account with privileges to edit a doc category index topic. The attacker inserts URLs referencing topic identifiers from private messages or restricted categories into the index. Upon the next index refresh, the plugin resolves those identifiers and returns titles into the rendered index, exposing them to the attacker.

ruby

// Security patch in app/services/doc_categories/index_structure_refresher.rb
           .filter_map { |link| DocCategories::Url.extract_topic_id_from_url(link[:href]) }
           .uniq
 
-      topics_by_id = ::Topic.where(id: topic_ids).index_by(&:id)
+      topics_by_id = ::Topic.where(id: topic_ids).includes(:category).index_by(&:id)
 
       raw_sections.filter_map do |section|
         links =

Source: GitHub Commit b15d4de

The patch preloads category associations so the plugin can evaluate the viewer's access rights against each resolved topic before including its title in the index output.

Detection Methods for CVE-2026-57447

Indicators of Compromise

Edits to doc category index topics that introduce URLs referencing topic IDs outside the current category scope.
Index topic revisions submitted by accounts that normally do not curate documentation structure.
Rendered doc indexes containing titles that correspond to private messages or restricted categories.

Detection Strategies

Review Discourse audit logs for revisions to index topics associated with the Doc Categories plugin and correlate linked topic IDs against category visibility rules.
Query the Discourse database to identify index topic links whose resolved Topic.category_id falls within restricted categories the editor cannot otherwise access.
Compare historical index renderings to detect titles that reference personal messages or non-public categories.

Monitoring Recommendations

Alert on changes to topics tagged as doc category indexes, especially outside maintenance windows.
Track accounts holding edit rights over index topics and periodically validate their category permissions.
Monitor plugin version strings during Discourse upgrades to confirm the patched commit is deployed.

How to Mitigate CVE-2026-57447

Immediate Actions Required

Update the Discourse Doc Categories plugin to a version that includes commit b15d4de02ad29d7c9525346afee51fef4a2c605a or later.
Audit which users currently hold edit permissions on doc category index topics and revoke access that is not operationally required.
Review existing index topics for links that reference restricted-category topics or private messages and remove them.

Patch Information

The fix is published in commit b15d4de02ad29d7c9525346afee51fef4a2c605a within the Discourse Doc Categories repository. Refer to the GitHub Security Advisory GHSA-x63p-48vw-8r64 for the authoritative advisory, and the patch commit for the code change that eager-loads category data to enable authorization checks.

Workarounds

Restrict index topic edit permissions to a small set of trusted documentation maintainers until the patched plugin version is deployed.
Temporarily disable automatic index refresh for doc categories if the deployment supports it, and rebuild indexes manually under administrative review.
Separate restricted categories and private messages into Discourse instances that do not run the Doc Categories plugin, where feasible.

bash

# Update the Discourse Doc Categories plugin to the patched revision
cd /var/discourse
./launcher enter app
cd plugins/discourse-doc-categories
git fetch origin
git checkout b15d4de02ad29d7c9525346afee51fef4a2c605a
exit
./launcher rebuild app