Privilege Escalation in Discourse by Unauthorized Access to Private Topics

CVE-2026-32615

What is CVE-2026-32615?

Discourse, an open-source discussion platform, contains a vulnerability that allows category group moderators to execute unauthorized privileged actions on topics within private categories where they lack proper read access. This security oversight was present in multiple versions of the software, specifically between 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. The vulnerability has been addressed in subsequent releases: 2026.1.3, 2026.2.2, and 2026.3.0, ensuring enhanced access control and improved security measures for users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References