CVE-2026-32619

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32619
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32619.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32619
Aliases
Published
2026-03-31T17:40:41.588Z
Modified
2026-04-10T05:42:23.270285Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories
Details

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, users who lost access to a topic (e.g., removed from a private category group) could still interact with polls in that topic, including voting and toggling poll status. No content was exposed, but users could modify poll state in topics they should no longer have access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32619.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
b3f024ce9587e678216892cbd967201b2450e197
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
f7cec86997edc21d6074ceb7666f7e2e6e1b1fdf
Fixed
4431801e7b5af883edb430643fdace7608ffb6fb
Database specific 
{
    "versions": [
        {
            "introduced": "2026.2.0-latest"
        },
        {
            "fixed": "2026.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
896e810e1b296478bba91559a8fc89a9926f11fe
Fixed
896e810e1b296478bba91559a8fc89a9926f11fe
Database specific 
{
    "versions": [
        {
            "introduced": "2026.3.0-latest"
        },
        {
            "fixed": "2026.3.0"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.2.0
v2026.2.0-latest
v2026.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32619.json"