CVE-2026-57447

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57447

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57447.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57447

Aliases

GHSA-x63p-48vw-8r64

Published

2026-10-16T15:31:10Z

Modified

2026-10-17T02:48:24Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Discourse Doc Categories: Doc category index refresh leaks private topic titles

Details

Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use this behavior to learn titles that the user is not authorized to view, although the advisory does not establish access to topic contents. This vulnerability is addressed by commit b15d4de02ad29d7c9525346afee51fef4a2c605a.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-200"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57447.json"
}

References

Affected packages

Git / github.com/discourse/discourse-doc-categories

Affected ranges

Type: GIT
Repo: https://github.com/discourse/discourse-doc-categories
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

b15d4de02ad29d7c9525346afee51fef4a2c605a

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57447.json"