Summary
Discourse sites with secure uploads enabled could leave media and attachments publicly accessible after a category became restricted or its permissions changed during a bulk import. Anonymous users may have continued to retrieve these files through short upload URLs, including files associated with deleted topics.
Discourse sites with secure uploads enabled could leave media and attachments publicly accessible after a category became restricted or its permissions changed during a bulk import. Anonymous users may have continued to retrieve these files through short upload URLs, including files associated with deleted topics.
Affected context
The issue occurs in Discourse deployments using secure uploads when upload security metadata is not reconciled after category visibility or permission changes. Files uploaded while a category was public may retain a public accessibility flag, allowing access after the category becomes restricted or its associated topic is deleted.
The issue occurs in Discourse deployments using secure uploads when upload security metadata is not reconciled after category visibility or permission changes. Files uploaded while a category was public may retain a public accessibility flag, allowing access after the category becomes restricted or its associated topic is deleted.
Exploit preconditions
- Attack surface: Publicly reachable Discourse upload URLs
- Required access: Knowledge of, or access to, a short upload URL; authenticated access is not necessarily required
- Trigger point: Retrieval of an upload whose category permissions changed after the file was created
- Why exploitation is possible: Existing upload metadata can remain more permissive than the current category authorization state
- Attack surface: Publicly reachable Discourse upload URLs
- Required access: Knowledge of, or access to, a short upload URL; authenticated access is not necessarily required
- Trigger point: Retrieval of an upload whose category permissions changed after the file was created
- Why exploitation is possible: Existing upload metadata can remain more permissive than the current category authorization state
Why this happens
The underlying flaw is an authorization-state synchronization failure. When category visibility or permissions changed, Discourse did not consistently recalculate the access metadata associated with existing uploads, including uploads retained after topic deletion. This maps primarily to CWE-863: Incorrect Authorization, with CWE-200: Exposure of Sensitive Information describing the resulting disclosure when protected content remains publicly reachable.
The underlying flaw is an authorization-state synchronization failure. When category visibility or permissions changed, Discourse did not consistently recalculate the access metadata associated with existing uploads, including uploads retained after topic deletion. This maps primarily to CWE-863: Incorrect Authorization, with CWE-200: Exposure of Sensitive Information describing the resulting disclosure when protected content remains publicly reachable.
Potential impact
- Anonymous users may access attachments or media intended for restricted categories
- Sensitive files could be disclosed through previously issued short URLs
- Deleted-topic uploads may remain reachable after their parent content is removed
- Organizations could experience privacy violations, data exposure, or compliance impact
- Anonymous users may access attachments or media intended for restricted categories
- Sensitive files could be disclosed through previously issued short URLs
- Deleted-topic uploads may remain reachable after their parent content is removed
- Organizations could experience privacy violations, data exposure, or compliance impact
General mitigation guidance
Mitigation typically focuses on keeping object-level authorization synchronized with the current resource policy.
Common defensive patterns include:
- Reconcile upload visibility whenever category permissions or topic ownership changes
- Evaluate authorization at request time against current category and topic policy
- Invalidate or rotate public upload URLs when content becomes restricted
- Apply conservative, private-by-default access settings to newly created uploads
- Treat bulk imports and permission migrations as security-sensitive operations
- Use least-privilege service permissions and limit anonymous media access
- Include deleted-content handling in upload retention and authorization workflows
Mitigation typically focuses on keeping object-level authorization synchronized with the current resource policy.
Common defensive patterns include:
- Reconcile upload visibility whenever category permissions or topic ownership changes
- Evaluate authorization at request time against current category and topic policy
- Invalidate or rotate public upload URLs when content becomes restricted
- Apply conservative, private-by-default access settings to newly created uploads
- Treat bulk imports and permission migrations as security-sensitive operations
- Use least-privilege service permissions and limit anonymous media access
- Include deleted-content handling in upload retention and authorization workflows
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis and code review checks for authorization decisions based only on stale upload metadata
- Review of permission-change, bulk-import, deletion, and attachment-serving workflows
- Tests that change category visibility after upload creation and verify access is reevaluated
- Monitoring for anonymous requests to files associated with restricted or deleted content
- Policy checks requiring object-level authorization before serving media
- Automated security testing that compares current resource permissions with effective upload access
Organizations can identify similar issues through:
- Static analysis and code review checks for authorization decisions based only on stale upload metadata
- Review of permission-change, bulk-import, deletion, and attachment-serving workflows
- Tests that change category visibility after upload creation and verify access is reevaluated
- Monitoring for anonymous requests to files associated with restricted or deleted content
- Policy checks requiring object-level authorization before serving media
- Automated security testing that compares current resource permissions with effective upload access
