CVE-2026-45788: Discourse Secure Uploads Exposure via pull_hotlinked_images

Technical summary

The vulnerability exists in Discourse's secure upload implementation and the pull_hotlinked_images mechanism. Secure uploads are designed to generate obfuscated URLs that are not directly guessable or enumerable. However, if an attacker obtains knowledge of a secure upload URL (through disclosure, social engineering, or enumeration), the pull_hotlinked_images function does not properly validate whether the requestor has authorization to access that secured content. The function pulls images from external URLs and stores them locally, but when applied to secure upload URLs, it fails to enforce the same access controls that would normally protect those uploads. This results in exposure of content that should be restricted.

Business impact

Organizations running Discourse as an internal discussion platform, customer support hub, or community forum may face information disclosure risks. If secure_uploads is enabled to protect sensitive documents, proprietary discussions, or confidential customer data, an attacker with knowledge of a URL could access that content without proper authorization. For public-facing communities, the risk is lower but still relevant if private board discussions or member-uploaded files are assumed to be protected. This could lead to compliance violations if regulated data is exposed, reputational harm, or competitive disadvantage.

Affected systems

Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5 are affected. Organizations running any of these older versions with the secure_uploads site setting enabled are at risk. The vulnerability does not affect instances where secure_uploads is disabled or organizations already running the patched versions.

Exploitability

The vulnerability has a network attack vector with low attack complexity and no authentication required, making it relatively straightforward to exploit if an attacker possesses or discovers a secured upload URL. The barrier to exploitation is knowledge of the target URL; the attacker does not need credentials or complex manipulation. However, the attack is not automatic—it requires the attacker to first know or guess a valid secure upload URL, which adds practical friction to widespread exploitation.

Remediation

Upgrade Discourse to one of the following patched versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. Version selection depends on your current Discourse release cycle. Verify against the official Discourse advisory which version is appropriate for your deployment. After patching, the pull_hotlinked_images function will properly enforce access controls on secured uploads.

Patch guidance

Organizations should prioritize upgrading within their standard maintenance windows. The patches are available across multiple release branches to accommodate different update cadences. If your instance is on a long-term support or stable channel, ensure you select the correct patched version for that branch. Test the upgrade in a non-production environment first to confirm compatibility with any custom plugins or configurations. No configuration changes are required post-patch.

Detection guidance

Review Discourse logs for unusual pull_hotlinked_images requests targeting secure upload URLs. Look for requests to URLs containing secure upload path patterns combined with successful content retrieval by unauthorized users or API consumers. Monitor for multiple attempts to access secured uploads from the same source IP or account. If secure_uploads is enabled and you suspect historical exploitation, audit file access logs and user activity around sensitive uploads to identify what may have been accessed.

Why prioritize this

This vulnerability earns a HIGH severity rating due to its high confidentiality impact and ease of exploitation (network-accessible, no authentication required). While the attack requires prior knowledge of a URL, the presence of secure_uploads typically indicates the administrator considers content confidential. Any organization relying on Discourse's secure upload feature for regulated or sensitive data should prioritize this patch. However, it is not a critical remote code execution or denial-of-service issue, so it can be scheduled within normal patch management cycles rather than treated as emergency out-of-band work.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack vector, low attack complexity, no privilege or user interaction required, and high confidentiality impact with no integrity or availability loss. The score appropriately captures that this is a targeted information disclosure vulnerability. Organizations with sensitive data in Discourse should treat this as higher priority within their environment; those using Discourse for public discussion only may rate it lower.

Frequently asked questions