{"id":"CVE-2026-57447","kind":"vulnerability","aliases":["CVE-2026-57447"],"related":[],"title":"Discourse Doc Categories: index refresh leaks titles of restricted topics","description":"Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use this behavior to learn titles that the user is not authorized to view, although the advisory does not establish access to topic contents. This vulnerability is addressed by commit b15d4de02ad29d7c9525346afee51fef4a2c605a.","summary":"The Discourse Doc Categories plugin resolves linked topic titles in its documentation index without checking the viewer's permissions. A user who can edit the index topic can learn titles of private messages and restricted-category topics they cannot read.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["discourse","package","plugin","self-hosted"],"not_affected_if":["no-doc-categories-plugin","no-restricted-linked-topics"],"how_to_check":"- Check whether the Discourse Doc Categories plugin is installed in the site's plugins directory or `app.yml` and compare its commit against `b15d4de02ad29d7c9525346afee51fef4a2c605a`\n- Check the plugin version or git revision with `git -C <plugin-dir> rev-parse HEAD` unknown whether a fixed release tag exists","fix":"- Update the Discourse Doc Categories plugin to a build that includes commit `b15d4de02ad29d7c9525346afee51fef4a2c605a`\n- Rebuild and restart the Discourse container after updating the plugin","status":"open","published_at":"2026-10-16T16:18:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:39:58+00:00","updated_at":"2026-10-25T04:39:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:39:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Discourse Doc Categories plugin to a build that includes commit `b15d4de02ad29d7c9525346afee51fef4a2c605a`\n- Rebuild and restart the Discourse container after updating the plugin","reach":"internet","title":"Discourse Doc Categories: index refresh leaks titles of restricted topics","impact":"low","summary":"The Discourse Doc Categories plugin resolves linked topic titles in its documentation index without checking the viewer's permissions. A user who can edit the index topic can learn titles of private messages and restricted-category topics they cannot read.","category":"package","nicknames":[],"who_cares":["discourse","self-hosted","plugin"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker learns titles of restricted topics they cannot open","analyst_note":"","how_to_check":"- Check whether the Discourse Doc Categories plugin is installed in the site's plugins directory or `app.yml` and compare its commit against `b15d4de02ad29d7c9525346afee51fef4a2c605a`\n- Check the plugin version or git revision with `git -C <plugin-dir> rev-parse HEAD` unknown whether a fixed release tag exists","needs_analyst":false,"not_affected_if":["no-doc-categories-plugin","no-restricted-linked-topics"],"who_is_affected":"Sites running the Discourse Doc Categories plugin that use doc category index topics with links to private messages or restricted-category topics. Sites without this plugin, or without doc category index topics linking to restricted content, have little exposure. The advisory does not establish access to topic contents, only titles.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3378,"output_tokens":606,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-57447':13A,16A 'access':132C 'address':139C 'advisori':128C 'although':126C 'author':102C,123C 'b15d4de02ad29d7c9525346afee51fef4a2c605a':142C 'behavior':114C 'cannot':62B 'categori':3A,26B,59B,66C,84C,95C 'check':37B 'commit':141C 'content':135C 'cve':11A,14A 'discours':1A,17B,24B,64C,72C 'doc':2A,25B,65C,83C 'document':34B,75C 'edit':46B,107C 'enforc':98C 'establish':131C 'fix':81C 'host':22B 'index':4A,35B,48B,85C,109C 'leak':6A 'learn':51B,116C 'link':29B,88C 'messag':55B,92C 'organ':71C 'packag':18B 'permiss':41B 'plugin':19B,27B,69C 'prior':76C 'privat':54B,91C 'read':63B 'refresh':5A,86C 'resolv':28B,87C 'restrict':9A,58B,94C 'restricted-categori':57B 'self':21B 'self-host':20B 'sourc':80C 'titl':7A,31B,52B,89C,117C 'topic':10A,30B,49B,60B,73C,96C,110C,134C 'use':112C 'user':43B,104C,120C 'verifi':79C 'view':125C 'viewer':39B,100C 'vulner':137C 'without':36B,97C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Discourse Doc Categories plugin that use doc category index topics with links to private messages or restricted-category topics. Sites without this plugin, or without doc category index topics linking to restricted content, have little exposure. The advisory does not establish access to topic contents, only titles.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57447","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57447","severity":null,"published_at":"2026-10-16T16:18:44+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}