CVE Catalog
CVE-2026-32618
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.20%
10th percentile - higher than 10% of all known CVEs
Summary
Discourse allows inference of chat channel membership from user search without proper authorization.
Risk Assessment
An attacker can determine which users belong to private chat channels, violating privacy and potentially revealing sensitive information.
Recommendation
Update Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.