The Discourse Doc Categories plugin contains a flaw that allows the category index refresh operation to resolve titles of private messages or restricted topics without enforcing the viewer’s authorization. As a result, a user who has edit permission on the index topic can discover the titles of topics that are otherwise off‑limits, leaking private or confidential information. This vulnerability falls under the confidentiality weakness CWE‑200 and does not grant direct access to the content of the topics, but the exposure of titles can still be valuable to an attacker.

The vulnerability affects installations of the Discourse Doc Categories plugin for the Discourse forum platform. Any instance that has not applied the fix contained in commit b15d4de02ad29d7c9525346afee51fef4a2c605a is susceptible. Specific version numbers are not disclosed in the advisory; the plugin should be updated to a version that includes this commit.

The CVSS score is 4.3, indicating low to moderate severity, and no EPSS score is provided, so the exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Exploitation requires that the attacker have edit rights on the index topic, which limits the threat to users with elevated privileges or a malicious administrator. The likely attack vector is internal or local; an attacker can trigger a refresh of the index and read the leaked titles. No remote code execution or content disclosure is possible. Overall, the risk is moderate, tied to privileged access within the forum.