CVE-2026-32620
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Discourse allows non-staff users to access read receipt information for staff-only posts. Metadata (who read and when) is exposed, but not post content.
Risk Assessment
Disclosure of read receipt metadata can allow inference about staff activity, constituting a breach of confidentiality.
Recommendation
Update Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.