Authorization Bypass in Discourse Doc Categories Plugin

CVE-2026-57447

What is CVE-2026-57447?

The Discourse Doc Categories plugin is susceptible to an authorization bypass issue, where the index refresh inadvertently reveals titles of private messages or restricted topics to users without appropriate permissions. This vulnerability allows users with editing capabilities on the index topic to access titles they shouldn't be able to view, posing potential privacy concerns. While the advisory clarifies that access to the actual content is not compromised, it still raises significant security implications that require attention. Mitigation for this issue has been implemented in the recent fix.

References