https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T04:07:19.522939+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-discourse-2026-72722 BIT-discourse-2026-72722 — Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs 2026-10-13T04:07:19.525206+00:00

Affected: Bitnami: discourse

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

 https://cve.radiocsirt.org/vuln/euvd-2026-352256 EUVD-2026-352256 2026-10-13T04:07:19.525250+00:00 EUVD-2026-352256 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72722 fkie_cve-2026-72722 2026-10-13T04:07:19.525265+00:00

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup do not consistently enforce Guardian.can_see? checks when processing internal links. An authenticated user can submit links to restricted topics, private messages, or hidden posts and receive canonicalized slugs or titles in the composer_messages duplicate_lookup response even though the targets are not visible to that user. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.