CVE-2026-72722: Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composermessages duplicatelookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.6 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.5.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.6.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72722?
The severity of CVE-2026-72722 is categorized as medium with a score of 4.3.
How do I fix CVE-2026-72722?
To fix CVE-2026-72722, update Discourse to versions 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.
What type of vulnerability is CVE-2026-72722?
CVE-2026-72722 is a vulnerability that allows authenticated users to access restricted topic titles through improperly enforced checks.
Who is affected by CVE-2026-72722?
Authenticated users of Discourse prior to the fixed versions are affected by CVE-2026-72722.
What components are involved in CVE-2026-72722?
CVE-2026-72722 involves the TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup components of Discourse.