PT-2026-5211 · Discourse · Discourse

Davidtaylorhq · Published 2026-01-28 · Updated 2026-01-31 · CVE-2026-23743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 3.5.4 Discourse versions prior to 2025.11.2 Discourse versions prior to 2025.12.1 Discourse versions prior to 2026.1.0

Description Discourse is an open source discussion platform. Permalinks to access-restricted resources, such as private topics, categories, posts, or hidden tags, were redirecting users to URLs that revealed the resource slug, even when the user lacked the necessary permissions. This resulted in the leakage of potentially sensitive information, including private topic titles, through the redirect Location header and the search box on the 404 page.

Recommendations Update Discourse to version 3.5.4 or later. Update Discourse to version 2025.11.2 or later. Update Discourse to version 2025.12.1 or later. Update Discourse to version 2026.1.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-DISCOURSE-2026-23743

CVE-2026-23743

GHSA-V5JW-RXC6-4CVV

Affected Products

Discourse

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23743.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23743 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23743 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-23743 · Vendor Advisory
• https://github.com/discourse/discourse/security/advisories/GHSA-v5jw-rxc6-4cvv · Note
• https://twitter.com/CVEnew/status/2016616576414335420 · Twitter Post
• https://t.me/CVEtracker/43191 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2016681191844278402 · Twitter Post