---
id: "CVE-2026-57447"
kind: "vulnerability"
aliases: ["CVE-2026-57447"]
title: "Discourse Doc Categories: index refresh leaks titles of restricted topics"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["discourse", "package", "plugin", "self-hosted"]
not_affected_if: ["no-doc-categories-plugin", "no-restricted-linked-topics"]
published_at: "2026-10-16T16:18:44+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:39:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57447", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Discourse Doc Categories: index refresh leaks titles of restricted topics

The Discourse Doc Categories plugin resolves linked topic titles in its documentation index without checking the viewer's permissions. A user who can edit the index topic can learn titles of private messages and restricted-category topics they cannot read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Discourse Doc Categories plugin is installed in the site's plugins directory or `app.yml` and compare its commit against `b15d4de02ad29d7c9525346afee51fef4a2c605a`
- Check the plugin version or git revision with `git -C <plugin-dir> rev-parse HEAD` unknown whether a fixed release tag exists

## Fix

- Update the Discourse Doc Categories plugin to a build that includes commit `b15d4de02ad29d7c9525346afee51fef4a2c605a`
- Rebuild and restart the Discourse container after updating the plugin

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57447

## From the sources

Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can use this behavior to learn titles that the user is not authorized to view, although the advisory does not establish access to topic contents. This vulnerability is addressed by commit b15d4de02ad29d7c9525346afee51fef4a2c605a.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_