Medium · published January 28, 2026
⚠️ A pesky redirect is leaking sensitive info! Users without access to private resources are still seeing their titles in the 404 URL, much like a secret menu item getting accidentally shouted out in a restaurant. 🍽️ Think of it like a restaurant that accidentally lets customers see the names of dishes meant for VIPs when they try to order from the regular menu. Even though they can’t access those dishes, the names are laid bare, potentially revealing confidential information! An attacker could glean the existence and titles of private topics or hidden tags, which could be a serious privacy breach. Imagine someone being able to see exclusive content simply by peeking at the menu, even if they can't actually order it. This could lead to unwanted exposure of sensitive discussions!
Think of it like a restaurant that accidentally lets customers see the names of dishes meant for VIPs when they try to order from the regular menu. Even though they can’t access those dishes, the names are laid bare, potentially revealing confidential information! This vulnerability in Discourse allows permalinks for access-restricted resources to leak sensitive information via the Location header in a redirect, exposing private topic titles even to unauthorized users. It affects versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0.
An attacker could glean the existence and titles of private topics or hidden tags, which could be a serious privacy breach. Imagine someone being able to see exclusive content simply by peeking at the menu, even if they can't actually order it. This could lead to unwanted exposure of sensitive discussions! Upgrade your Discourse instance to versions 3.5.4, 2025.11.2, 2025.12.1, or 2026.1.0 to patch this issue. Since there are no workarounds, patching is crucial to protect your users' privacy! You've got this! Follow these steps, and you'll keep those secrets safe and sound. 🛡️