Discourse users can submit internal links pointing to topics, private messages, or hidden posts that they do not have permission to view. The application’s link processing functions fail to apply the Guardian.can_see? checks consistently, so the bogus or duplicate link lookup returns the canonicalized slug or title of the restricted content. This missing authorization weakness, identified as CWE-862, allows an authenticated attacker to learn the existence and titles of otherwise invisible resources, which could aid in enumeration or social engineering.

This issue affects the Discourse discussion platform, specifically releases prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. Users running any of those versions are vulnerable if they permit link submissions.

The CVSS score of 4.3 indicates a moderate risk profile. The EPSS metric is not available, and the vulnerability is not listed in CISA’s KEV catalog, so no current evidence of widespread exploitation exists. Because the flaw requires an authenticated user and relies on standard link submission, attackers could exploit it by simply adding a private link in the composer; the vulnerability therefore has a practical attack surface for legitimate users with access to the platform.