CVE-2026-72722: Discourse Auth Bypass Vulnerability

CVE-2026-72722 Overview

CVE-2026-72722 is a missing authorization vulnerability [CWE-862] in Discourse, an open-source discussion platform. The flaw resides in the TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup methods. These methods do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts. The composer_messages duplicate_lookup response returns canonicalized slugs or titles even when the target is not visible to the requesting user. The issue affects Discourse versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Critical Impact
Authenticated attackers can enumerate titles and slugs of restricted topics, private messages, and hidden posts they lack permission to access, resulting in information disclosure.

Affected Products

Discourse versions prior to 2026.1.6
Discourse versions prior to 2026.5.2 and 2026.6.1
Discourse versions prior to 2026.7.0

Discovery Timeline

2026-08-10 - CVE CVE-2026-72722 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72722

Vulnerability Analysis

The vulnerability exists in Discourse's topic-linking logic within app/models/topic_link.rb. Three methods handle internal link processing: extract_from, ensure_entry_for, and duplicate_lookup. These methods failed to consistently invoke Guardian.can_see? when resolving link targets. As a result, the composer duplicate-lookup response leaks canonicalized slugs and titles for topics the requesting user is not authorized to view.

An authenticated user can craft a post containing links to arbitrary internal URLs. When the composer performs duplicate lookup, the server returns metadata for the linked targets. Restricted topics, private messages, and hidden posts are exposed through their titles and slug strings.

Root Cause

The root cause is missing authorization enforcement [CWE-862] within TopicLink methods. Discourse relies on the Guardian class to gate visibility decisions across the application. The affected methods bypassed Guardian.can_see? when canonicalizing link targets, breaking the platform's access-control invariant.

Attack Vector

Exploitation requires network access and an authenticated Discourse account with low privileges. No user interaction beyond normal composer use is required. The attacker submits or previews a post containing candidate URLs and observes the composer response for leaked titles or slugs.

ruby

# Patched code in app/models/topic_link.rb
def self.extract_from(post)
  return if post.blank? || post.whisper? || post.user_id.blank? || post.deleted_at.present?

  guardian = post.acting_user.guardian
  current_urls = []
  reflected_ids = []

Source: Discourse commit 45abd925

The patch introduces a guardian instance derived from post.acting_user. Subsequent visibility checks use this guardian to enforce can_see? semantics before returning link metadata.

Detection Methods for CVE-2026-72722

Indicators of Compromise

Unusual volume of composer_messages duplicate_lookup requests originating from a single authenticated session
Post drafts or previews containing large numbers of internal URLs to restricted categories or private message routes
Repeated enumeration of sequential topic IDs or slug patterns from low-privileged accounts

Detection Strategies

Review application logs for /composer_messages and /drafts endpoint activity paired with links to restricted category IDs
Correlate authenticated user sessions with access attempts to topics outside their permitted categories
Alert on user accounts that submit posts referencing internal URLs at rates inconsistent with normal forum usage

Monitoring Recommendations

Ingest Discourse Rails and Nginx access logs into a centralized log platform for correlation and long-term retention
Baseline normal composer duplicate-lookup traffic per user role and flag statistical outliers
Monitor for privilege-relevant events such as attempts by non-staff users to reference staff-only or PM URLs

How to Mitigate CVE-2026-72722

Immediate Actions Required

Upgrade Discourse to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 depending on your release branch
Audit recent composer_messages traffic for evidence of enumeration against restricted topics or private messages
Rotate or review access for user accounts observed probing internal URLs prior to patching

Patch Information

Discourse fixed the issue across four release branches. Refer to the GitHub Security Advisory GHSA-4fx9-5m29-83p4 for coordinated details. The corrective commits are 45abd925, 7d7ce546, 836a251d, and e54ba27e. Corresponding pull requests are #42091, #42092, #42093, and #42094.

Workarounds

No official workaround exists; upgrading to a fixed release is the supported remediation
Temporarily restrict new-user posting privileges via trust-level configuration to reduce the population of accounts able to abuse composer lookups
Increase rate limits on composer and draft endpoints to slow bulk enumeration attempts

bash

# Upgrade a standard Docker-based Discourse deployment
cd /var/discourse
git pull
./launcher rebuild app