CVE-2026-91157: Discourse: Media uploads remain publicly accessible after category permissions are restricted
Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did not reconcile existing upload security metadata when a previously public category became read-restricted or when category permissions changed during a bulk import. Media and attachments uploaded while the category was public retained a public accessibility flag and remained reachable by anonymous users through their short upload URLs, including uploads associated with deleted topics. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.9.0 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.8.1 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.7.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.9
Event History
Frequently Asked Questions
Which deployments are exposed?
Affected deployments are Discourse sites with secure uploads enabled where a category that was previously public was later made read-restricted, or where category permissions changed during a bulk import. Uploads created while the category was public may remain anonymously accessible.
What would an attacker need to access affected media?
No authentication or user interaction is required. An anonymous user who has an affected upload's short URL can retrieve the media or attachment, including uploads associated with deleted topics.
Does deleting a topic remove exposure of its uploads?
Not necessarily. The issue explicitly includes uploads associated with deleted topics when those uploads retained their public accessibility flag.
Which versions contain the fix?
The issue is fixed in Discourse versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9. Deployments prior to those versions are affected under the described conditions.