Title disclosure via unchecked index-link resolution
Published Oct 16, 2026 · Updated Oct 16, 2026
Discourse Doc Categories index refresh allows remote authenticated users to read private topic titles through index-topic links. The DocCategories::IndexStructureRefresher build_sections method retrieves titles using topic IDs from index links without checking whether viewers can access the targets. Exploitation requires permission to edit a documentation category's index topic; the established disclosure covers private-message and restricted-category titles, not topic contents.
Summary
What happened
Discourse Doc Categories index refresh allows remote authenticated users to read private topic titles through index-topic links. The DocCategories::IndexStructureRefresher build_sections method retrieves titles using topic IDs from index links without checking whether viewers can access the targets. Exploitation requires permission to edit a documentation category's index topic; the established disclosure covers private-message and restricted-category titles, not topic contents.
The record
- CVE
- CVE-2026-57447
- Published
- Oct 16, 2026
- Updated
- Oct 16, 2026
- Vendor
- Discourse
- Product
- Discourse Doc Categories
- Classifications
- CWE-200, T1213
- Attack vector
- network
- Privileges
- authenticated
Timeline
How it unfolded
- Oct 16, 2026CVE publishedPublication date reported by the CVE source.
- Oct 16, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=< b15d4de02ad29d7c9525346afee51fef4a2c605a
What conditions does exploitation require?
What is affected?
Published CVSS scores
CVSS describes severity. EPSS estimates exploitation probability.
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Activity data is delayed. The latest report is Sep 28, 2026.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Get started to see how Hinoki identifies affected software and validates exploitability in your environment.
Get started