Exposure of Resource to Wrong Sphere in Discourse - #VU165854
Published: November 11, 2026
Vulnerability identifier: #VU165854
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-668
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to make another site in a Discourse multisite cluster serve attacker-controlled content, including theme JavaScript.
The vulnerability exists due to exposure of resources across site boundaries in Discourse disk caches when multiple sites share a multisite cluster. A remote privileged user can use administrative control of one site to influence shared cached content and cause another site to serve that content.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1