Open-Source Discussion Platform Vulnerability in Discourse
CVE-2026-32113
What is CVE-2026-32113?
A vulnerability exists in Discourse, an open-source discussion platform, where the StaticController's enter action can read the sso_destination_url cookie without validating its content. This lack of validation allows attackers to redirect users to untrusted external sites, potentially leading to phishing attacks or data theft. The issue affects versions 2026.1.0-latest through 2026.1.2, 2026.2.0-latest through 2026.2.1, and 2026.3.0-latest. Patches were released in subsequent versions to enhance security against these redirection attacks.
Affected Version(s)
discourse >= 2026.1.0-latest, < 2026.1.3 < 2026.1.0-latest, 2026.1.3
discourse >= 2026.2.0-latest, < 2026.2.2 < 2026.2.0-latest, 2026.2.2
discourse >= 2026.3.0-latest, < 2026.3.0 < 2026.3.0-latest, 2026.3.0