Open-Source Discussion Platform Vulnerability in Discourse
CVE-2026-32113
What is CVE-2026-32113?
A vulnerability exists in Discourse, an open-source discussion platform, where the StaticController's enter action can read the sso_destination_url cookie without validating its content. This lack of validation allows attackers to redirect users to untrusted external sites, potentially leading to phishing attacks or data theft. The issue affects versions 2026.1.0-latest through 2026.1.2, 2026.2.0-latest through 2026.2.1, and 2026.3.0-latest. Patches were released in subsequent versions to enhance security against these redirection attacks.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
discourse >= 2026.1.0-latest, < 2026.1.3 < 2026.1.0-latest, 2026.1.3
discourse >= 2026.2.0-latest, < 2026.2.2 < 2026.2.0-latest, 2026.2.2
discourse >= 2026.3.0-latest, < 2026.3.0 < 2026.3.0-latest, 2026.3.0