CVE-2026-91157Published
Discourse: Media uploads remain publicly accessible after category permissions are restricted
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-91157 · Microsoft / collected KEV context
cve-program · CVE-2026-91157
- https://github.com/discourse/discourse/security/advisories/GHSA-298h-xgw6-4pv3
- https://github.com/discourse/discourse/commit/16017732981fdb3ee65d7b3c69c573610bf02aab
- https://github.com/discourse/discourse/commit/83f5f9f1df7ddc79ec0950e1b2038ba659635708
- https://github.com/discourse/discourse/commit/98f1c021d0e956cded5239a5d8a6afe2b9e1b7e7
- https://github.com/discourse/discourse/commit/b2fb98394b2636b29e850f06b0029f8ca8b48458
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.