CVE-2026-32615

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32615
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32615.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32615
Aliases
Published
2026-03-31T17:40:17.212Z
Modified
2026-04-10T05:42:24.520633Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse: Category group moderators can perform actions on topics in restricted categories without read access
Details

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32615.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
b3f024ce9587e678216892cbd967201b2450e197
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
f7cec86997edc21d6074ceb7666f7e2e6e1b1fdf
Fixed
4431801e7b5af883edb430643fdace7608ffb6fb
Database specific 
{
    "versions": [
        {
            "introduced": "2026.2.0-latest"
        },
        {
            "fixed": "2026.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
896e810e1b296478bba91559a8fc89a9926f11fe
Fixed
896e810e1b296478bba91559a8fc89a9926f11fe
Database specific 
{
    "versions": [
        {
            "introduced": "2026.3.0-latest"
        },
        {
            "fixed": "2026.3.0"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.2.0
v2026.2.0-latest
v2026.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32615.json"