The vulnerability occurs because Discourse encrypted upload metadata is not updated when a previously public category is made read‑restricted or when permissions are altered during a bulk import. A media file or attachment uploaded while the category is public keeps a public accessibility flag, allowing anyone who knows the short URL to view or download it, even if the category has become private or the topic has been deleted. The flaw enables unauthorized disclosure of content that was intended to be restricted, potentially exposing personal data, violating privacy policies, or aiding further threats. This vulnerability is a CWE‑200 and CWE‑863 flaw.

Misconfiguration is limited to the open‑source Discourse discussion platform. All releases older than 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 are vulnerable when secure uploads are enabled and a category changes from public to restricted or is affected by a bulk import. Upgrade to any of these four fixed releases removes the issue.

The CVSS score of 7.5 classifies the flaw as high severity. EPSS information is not available, but the lack of a KEV listing implies no widespread exploitation at the time of writing. Attackers can reach the vulnerable media simply by accessing a known or guessable short URL, so the attack vector is remote and does not require privileged credentials. Exploitation requires that the site has secure uploads enabled and that the category permissions have been modified after the upload; the attacker must only preserve the existing URL, making the flaw readily exploitable under these conditions.