CVE-2026-72722

Executive Summary

CVE-2026-72722 is a missing-authorization (CWE-862) information-disclosure vulnerability in Discourse, the open-source discussion platform. Discourse instances running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are affected; an authenticated low-privileged user can submit internal links referencing restricted topics, private messages, or hidden posts and receive their canonicalized slugs or titles back through the composer_messages duplicate_lookup response, even though those targets are not visible to the requesting account. The impact is limited to low-severity confidentiality loss (CVSS 4.3, Medium) — no integrity or availability impact, and no evidence of in-the-wild exploitation to date (EPSS 0.00324, 25.2% percentile; not listed in CISA KEV).

Technical Analysis

The vulnerability resides in the internal link-processing subsystem of Discourse. When a user composes a post or message containing internal links, the platform invokes a pipeline of functions responsible for extracting, persisting, and de-duplicating topic links. The NVD description specifically names three methods — TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup — and states that these methods do not consistently enforce Guardian.can_see? checks when processing internal links.

Guardian.can_see? is Discourse's standard authorization gate for determining whether a given actor is permitted to view a topic, post, or message. The flaw class is a missing authorization check (CWE-862): the link-processing code path performs its task (extracting link metadata, ensuring a TopicLink record exists, and looking up duplicate links for the composer) without first verifying that the current user has visibility of the linked target.

Attack surface: any authenticated user of a vulnerable Discourse community, regardless of role or group membership. The affected logic is reachable via the normal composer workflow — specifically the mechanism that produces the "composer_messages duplicate_lookup response," which is intended to warn authors about duplicate links. Because the authorization check is absent or inconsistently applied on this path, the response leaks metadata (canonicalized slugs and titles) about topics, private messages, and hidden posts belonging to categories or conversations the requester is not authorized to see.

No specific HTTP endpoint, parameter name, or request format is disclosed in the advisory beyond the term "composer_messages duplicate_lookup response." The exploitation mechanism is therefore described at the vulnerability-class level. The NVD description confirms the flaw is server-side and the attacker needs only an authenticated session; the confidentiality impact is triggered by the server's response content, not by any injection or memory-corruption primitive.

Affected versions: Discourse maintains multiple release lines (stable/beta/tests-passed), which is why four separate fixed versions are listed. All builds prior to the respective patched release are vulnerable. The OSV record tracks affected Git commit ranges, including 640840d818f4ee9375829ece0ef452923bb0c012 and 06d03da34c4ed09ea59f917f045ba250d2b6320d, both flagged as "unfixed" (i.e., vulnerable) until the corresponding patched release. Patch confidence is 2/4 (claimed by a single source, OSV), so the fix should be independently verified after upgrade.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-72722 as of this writing. The attack chain below is inferred strictly from the NVD description and the vulnerability class (CWE-862). Only the function names present in the description are referenced; no additional implementation details are assumed.

1. Reconnaissance / target identification: The attacker identifies a public-facing Discourse community (internet or intranet) running a vulnerable version. An account of any privilege level is sufficient, so the attacker registers an account or compromises existing low-privileged credentials. The attacker then identifies or guesses the URL slugs of restricted topics, private messages, or hidden posts — for example, via sidebar leakage, search-engine hints, shared links from other members, or predictable slugs.

2. Triggering the flaw class: The attacker composes a new post or message through the standard composer interface and includes internal links pointing to the restricted targets. The composer context invokes the internal link-processing pipeline — TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup — to extract link metadata, maintain the TopicLink table, and return duplicate-link warnings to the author. Because the pipeline does not consistently consult Guardian.can_see?, the duplicate_lookup path processes the restricted links as if the author had visibility rights.

3. Payload / execution method: No injection payload or crafted binary is required. The "payload" is simply a legitimate authenticated HTTP request containing internal links to unauthorized content. The server-side defect is the failure to enforce an authorization predicate (Guardian.can_see?) before including the linked targets in the composer_messages duplicate_lookup response. The response body therefore contains canonicalized slugs or titles of the restricted targets.

4. Post-exploitation impact: The attacker harvests the leaked metadata. Repeating the request across many candidate slugs allows systematic enumeration of restricted category names, private message subjects, and hidden post titles. While this does not expose full post content, the leaked titles/slugs can reveal sensitive program names, project codenames, personnel matters, or internal decision topics, and can be used to refine social-engineering campaigns or to prioritize further attacks against high-value discussions. The attacker cannot modify data or escalate privileges through this CVE alone.

Impact Assessment

• CVSS analysis (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 4.3): The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). It requires a valid account (PR:L) and has an unchanged scope (S:U). The only impact is Low confidentiality (C:L); integrity and availability are unaffected.
• Affected systems: Self-hosted Discourse instances running any build prior to the fixed releases (2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0). Discourse-hosted (discourse.org-managed) instances are upgraded by the vendor and are not affected once the service applies the patched versions.
• Blast radius: The disclosure is confined to the affected Discourse community. It exposes only metadata (canonicalized slugs and titles) of restricted topics, private messages, and hidden posts — not message bodies or attachments. However, in communities where private categories host sensitive discussions (board meetings, incident postmortems, HR matters, embargoed product plans), the leaked titles can be damaging and can enable targeted follow-on attacks.
• Business impact: Low-to-moderate depending on community sensitivity. The requirement of an authenticated account raises the barrier to entry and reduces the external attack surface. EPSS (0.00324, 25.2% percentile) and the absence of a CISA KEV listing indicate a low current threat of exploitation in the wild.

Detection Guidance

The detection rules below are signature-based on terminology present in the NVD description (e.g., duplicate_lookup, composer_messages, TopicLink, canonical). Because the exact HTTP route and parameter names are not publicly documented, operators should tune these rules to their actual logging schema and validate against a patched instance to eliminate false positives.

Sigma Rule

title: Discourse Duplicate-Link Lookup Metadata Disclosure (CVE-2026-72722)
id: 8a2c1c1a-9e3b-4d5a-8f6b-2c7d0a1b3e5f
status: experimental
description: >
  Detects HTTP responses from a Discourse instance that contain duplicate_lookup
  data with canonicalized slugs/titles — a pattern consistent with the
  missing-authorization disclosure described by CVE-2026-72722.
  Note: adjust field names to match the local HTTP log schema (Zeek http.log,
  nginx access logs, or a proxy/API gateway log source).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72722
author: Valters IT Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: generic
detection:
  selection_composer:
    http.url|contains:
      - "composer_messages"
  selection_response:
    http.response.body|contains:
      - "duplicate_lookup"
      - "canonical"
  condition: selection_composer and selection_response
falsepositives:
  - Legitimate duplicate-link warnings returned to authorized authors
  - Log sources that include response bodies of unrelated composer activity
level: low
tags:
  - attack.t1190
  - cve.2026.72722
  - cwe.862

YARA Rule

/*
  YARA rule for CVE-2026-72722
  Target: captured HTTP response bodies (PCAP extraction, proxy logs,
          WAF/API gateway buffers) containing Discourse composer_messages
          duplicate_lookup JSON responses.
  Caution: strings are derived from the NVD description; generic JSON keys
           such as "canonical" and "topics" may appear in benign traffic.
*/
rule discourse_cve_2026_72722_duplicate_lookup_leak
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Discourse composer_messages duplicate_lookup response with canonicalized topic metadata (CVE-2026-72722)"
        cve         = "CVE-2026-72722"
        cwe         = "CWE-862"
        date        = "2026-01-15"
        severity    = "medium"

    strings:
        $s1 = "duplicate_lookup" ascii
        $s2 = "TopicLink" ascii
        $s3 = "canonical" ascii
        $s4 = "composer_messages" ascii wide
        $s5 = "\"slug\"" ascii
        $s6 = "\"title\"" ascii

    condition:
        filesize < 2MB and
        // JSON response containing duplicate_lookup plus topic metadata
        ( $s1 and $s2 ) and
        ( $s3 or $s5 ) and
        ( $s6 or $s4 )
}

Suricata IDS Rule

# Suricata rule for CVE-2026-72722
# Detects HTTP responses whose body contains Discourse duplicate_lookup metadata
# together with canonicalized link fields, indicating a possible metadata leak.
# Tune the "to_client" direction and content strings to the local deployment.
alert http any any -> any any ( \
  msg:"ET POLICY Discourse Composer Duplicate-Lookup Response with Canonical Metadata (CVE-2026-72722)"; \
  flow:established,to_client; \
  file_data; \
  content:"duplicate_lookup"; fast_pattern; \
  content:"canonical"; within:2048; \
  content:"topic"; within:4096; \
  classtype:attempted-recon; \
  reference:cve,2026-72722; \
  reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72722; \
  sid:2026722; rev:1; )

Elastic Detection

// EQL detection for CVE-2026-72722
// Applies to web/proxy logs normalized to ECS (fields: url.path,
// http.response.status_code, http.response.body or http.response.body.content).
// If response bodies are not captured, replace the body condition with a
// uri condition on "composer_messages" and monitor response status 200.
any where
  event.category == "web" and
  http.response.status_code == 200 and
  ( url.path like "*composer*" or
    ( http.response.body like "*duplicate_lookup*" and
      http.response.body like "*canonical*" and
      http.response.body like "*TopicLink*" ) )

Splunk SPL Query

# Splunk SPL for CVE-2026-72722 — web/proxy access logs with response bodies
# Adjust index/sourcetype to the local logging infrastructure.
index=web sourcetype=*access* OR sourcetype=*proxy*
| where status=200
| search (
    uri="*composer*" OR
    response_body="*duplicate_lookup*" OR
    response_body="*TopicLink*"
  )
| rex field=uri "^(?<method>\S+) (?<path>\S+)"
| eval leak_indicator=if(match(response_body,"canonical") AND match(response_body,"duplicate_lookup"),"suspicious","normal")
| stats count min(_time) max(_time) by src_ip path leak_indicator
| where leak_indicator="suspicious"
| sort - count

Wazuh OSSEC Rule

<!--
  Wazuh local rule for CVE-2026-72722
  Matches web-server access logs and application logs that contain
  Discourse duplicate_lookup responses or composer_messages requests.
  Tune the <match> patterns to the fields present in the raw logs.
-->
<group name="discourse,cve-2026-72722,">
  <rule id="100727" level="6" frequency="12" timeframe="120">
    <if_sid>31500</if_sid>
    <match>duplicate_lookup|composer_messages</match>
    <regex offset="after_match">canonical|slug|title</regex>
    <description>Discourse duplicate-link lookup returning canonicalized topic metadata - possible auth bypass disclosure (CVE-2026-72722)</description>
    <group>discourse,cve-2026-72722,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100728" level="3">
    <match>duplicate_lookup</match>
    <description>Discourse composer duplicate-link lookup activity observed</description>
    <group>discourse,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — the fix is asserted by a single source (OSV) and has not been independently confirmed. Operators should verify the patched behavior on a staging instance before rolling out.

1. Immediate mitigations:

   • No vendor-provided workaround is available. If an immediate upgrade is not possible, treat the issue as an authenticated metadata-disclosure risk and restrict trust in community-searchable content.
   • Where feasible, restrict self-registration or place new accounts in a restricted trust level to reduce the pool of potential attackers (note: any authenticated account is sufficient, so this is a risk reduction, not a fix).
   • Review access logs and proxy/API logs for unusual bursts of requests to composer/link-processing functionality from single accounts.

2. Patch / upgrade steps:

   • Upgrade Discourse to 2026.1.6 (stable release line), or to 2026.5.2, 2026.6.1, or 2026.7.0 for the corresponding newer release lines, per the official release notes.
   • Because patch confidence is 2/4, validate the fix after upgrade: create a low-privileged test account, submit an internal link to a restricted topic via the composer, and confirm the duplicate_lookup response no longer returns the restricted title or canonicalized slug.
   • If the instance is Discourse-hosted, confirm with the vendor that the patched versions have been applied to the managed environment.

3. Long-term hardening:

   • Enforce the consistent use of Guardian.can_see? (or the platform's equivalent authorization predicate) across all link-processing and metadata-return code paths; add regression tests that specifically exercise restricted topics, private messages, and hidden posts through TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup.
   • Subscribe to Discourse security announcements and OSV feed for rapid awareness of future security releases.
   • Monitor EPSS and CISA KEV for changes in exploitation status; re-assess urgency if the CVE is later added to KEV.
   • Employ WAF/API-layer logging (and the detection rules above) to gain visibility into composer-related traffic even after patching, as a defense-in-depth measure.

References

1. NVD — CVE-2026-72722: https://nvd.nist.gov/vuln/detail/CVE-2026-72722
2. OSV vulnerability entry for CVE-2026-72722 (patch source): https://osv.dev/vulnerability/CVE-2026-72722
3. Discourse official GitHub releases (2026.1.6, 2026.5.2, 2026.6.1, 2026.7.0): https://github.com/discourse/discourse/releases
4. Discourse security announcements (Meta.Discourse): https://meta.discourse.org/tags/security
5. CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72722 is NOT listed (KEV: NO).

As of this report, no known threat-actor campaigns, exploit-in-the-wild evidence, or public exploit code for CVE-2026-72722 have been identified. The low EPSS score (0.00324) and absence from CISA KEV are consistent with a low, but non-zero, exploitation likelihood.