---
id: CVE-2026-91133
title: Discourse is an open-source discussion platform
summary: >-
  Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3,
  2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE
  metacharacters to upload-resolution patterns, causing wildcard input to select
  unre…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-943
vendor: discourse
product: discourse
affected:
  - discourse < 2026.8.0
  - 'discourse >= 2026.7.0-latest, < 2026.7.2'
  - 'discourse >= 2026.6.0-latest, < 2026.6.3'
  - 'discourse >= 2026.1.0-latest, < 2026.1.8'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T18:19:07.003'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91133'
references:
  - url: >-
      https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6
    label: security-advisories@github.com
  - url: 'https://github.com/discourse/discourse/pull/42882'
    label: security-advisories@github.com
  - url: >-
      https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T17:12:40.098136Z'
ingestedAt: '2026-09-24T17:48:30.387Z'
---

## Overview

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.