{"id":"CVE-2026-91133","title":"Discourse is an open-source discussion platform","summary":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unre…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-943"],"vendor":"discourse","product":"discourse","affected":["discourse < 2026.8.0","discourse >= 2026.7.0-latest, < 2026.7.2","discourse >= 2026.6.0-latest, < 2026.6.3","discourse >= 2026.1.0-latest, < 2026.1.8"],"published":"2026-09-24","updated":"2026-09-24","sourceUpdated":"2026-09-24T18:19:07.003","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-91133","references":[{"url":"https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","label":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","label":"security-advisories@github.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-24T17:12:40.098136Z"},"ingestedAt":"2026-09-24T17:48:30.387Z","slug":"CVE-2026-91133","body":"## Overview\n\nDiscourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}