CVE Explorer
CVE-2026-23743
Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, permalinks pointing to access-restricted resources (private topics, categories, posts, or hidden tags) were redirecting users to URLs containing the resource slug, even when the user didn't have access to view the resource. This leaked potentially sensitive information (e.g., private topic titles) via the redirect Location header and the 404 page's search box. This issue is patched in
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"discourse","vendor":"discourse","versions":[{"status":"affected","version":"< 3.5.4"},{"status":"affected","version":">= 2025.11.0-latest, < 2025.11.2"},{"status":"affected","version":">= 2025.12.0-latest, < 2025.12.1"},{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d45695f6c500be48727fb118e9e843f7c9ae11e649c0ba2b800803249855891a · sha256:90ddb3340580ec6e… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":6.9,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d45695f6c500be48727fb118e9e843f7c9ae11e649c0ba2b800803249855891a · sha256:90ddb3340580ec6e… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-200","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d45695f6c500be48727fb118e9e843f7c9ae11e649c0ba2b800803249855891a · sha256:90ddb3340580ec6e… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/discourse/discourse/security/advisories/GHSA-v5jw-rxc6-4cvv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/discourse/discourse/security/advisories/GHSA-v5jw-rxc6-4cvv"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d45695f6c500be48727fb118e9e843f7c9ae11e649c0ba2b800803249855891a · sha256:90ddb3340580ec6e… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.