The vulnerability occurs because Discourse encrypts upload metadata but does not reconcile it when a category that was public becomes read‑restricted or when permissions change during a bulk import. A media file or attachment uploaded while the category was public retains a public accessibility flag, allowing anyone who knows the short URL to view or download it—even if the category later becomes private or the topic was deleted. The flaw enables unauthorized disclosure of content that was intended to be restricted, potentially exposing personal data, violating privacy policies, or aiding further threats. This vulnerability is a CWE‑200 and CWE‑863 flaw.

The issue is limited to Discourse, the open‑source discussion platform. All releases older than 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 are vulnerable when secure uploads are enabled and a category changes from public to restricted or is impacted by a bulk import. Upgrade to any of these four fixed releases removes the issue.

The CVSS score of 7.5 classifies the flaw as high severity. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Attackers can reach the vulnerable media simply by accessing a known or guessable short URL, so the attack vector is remote and does not require privileged credentials. Exploitation requires that the site has secure uploads enabled and that the category permissions have been modified after the upload; the attacker must only preserve the existing URL, making the flaw readily exploitable under these conditions.