Authorization bypass through user-controlled key in Discourse - #VU166166
Published: November 13, 2026
Vulnerability identifier: #VU166166
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to copy or delete S3 files outside the temporary upload folder, including files belonging to other sites sharing the bucket.
The vulnerability exists due to authorization bypass through user-controlled keys in Discourse external upload records when restoring backups on sites using direct S3 uploads with allow_restore enabled. A remote privileged user can restore a crafted backup containing external upload records referencing files outside the temporary upload folder to cause unauthorized file copying or deletion.
Affected software
Discourse
Remediation
Install security update from vendor's website.
Discourse - addressed in versions 2026.7.5, 2026.9.2, 2026.10.1