This vulnerability arises from the failure to escape SQL LIKE metacharacters in upload resolution patterns. An attacker who is authenticated can provide characters such as % and _ so that the database pattern matching expands beyond the intended record. As a result, the system can return data about uploads that the user is not authorized to see, exposing original filenames and secure upload URLs.

The affected platform is Discourse, the open‑source discussion forum software. Versions earlier than 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0 are vulnerable. All earlier releases that use the same upload path resolution logic are at risk.

The CVSS score of 6.5 marks the vulnerability as medium severity. No EPSS score is currently available, and the issue is not listed in CISA's KEV catalog, suggesting no documented real‑world exploitation for now. Attackers need valid authentication to trigger the bypass, so the vulnerability is mitigated by the existing login process, but once authenticated they can read sensitive upload metadata. The exploit requires only normal user privileges and typical HTTP requests to the upload API, making it relatively straightforward for any logged‑in user to take advantage if no patch is applied.