Channel Membership Inference in Discourse Discussion Platform
CVE-2026-32618

4.3MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
31 March 2026

What is CVE-2026-32618?

Discourse, an open-source discussion platform, has a vulnerability that can potentially allow unauthorized users to infer channel memberships through chat user searches. This issue affects specific versions of the platform and has been addressed in later releases, specifically versions 2026.1.3, 2026.2.2, and 2026.3.0. Users are strongly encouraged to update their installations to safeguard against this risk.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.3 < 2026.1.0-latest, 2026.1.3

discourse >= 2026.2.0-latest, < 2026.2.2 < 2026.2.0-latest, 2026.2.2

discourse >= 2026.3.0-latest, < 2026.3.0 < 2026.3.0-latest, 2026.3.0

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/81fd89e7440...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.