CVE-2026-32620

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32620
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32620.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-32620
Aliases
Published
2026-03-31T17:41:03.246Z
Modified
2026-04-10T05:42:24.638071Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Discourse: Missing post-level authorization allows whisper metadata disclosure
Details

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32620.json"
}
References

Affected packages

Git / github.com/discourse/discourse

Affected ranges

Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
322d3c0ac6a8f133b3f82875e9dbbe310f638c1b
Fixed
b3f024ce9587e678216892cbd967201b2450e197
Database specific 
{
    "versions": [
        {
            "introduced": "2026.1.0-latest"
        },
        {
            "fixed": "2026.1.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
f7cec86997edc21d6074ceb7666f7e2e6e1b1fdf
Fixed
4431801e7b5af883edb430643fdace7608ffb6fb
Database specific 
{
    "versions": [
        {
            "introduced": "2026.2.0-latest"
        },
        {
            "fixed": "2026.2.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/discourse/discourse
Events
Introduced
896e810e1b296478bba91559a8fc89a9926f11fe
Fixed
896e810e1b296478bba91559a8fc89a9926f11fe
Database specific 
{
    "versions": [
        {
            "introduced": "2026.3.0-latest"
        },
        {
            "fixed": "2026.3.0"
        }
    ]
}

Affected versions

Other
esr
stable
v2026.*
v2026.1.0
v2026.1.0-latest
v2026.1.1
v2026.1.2
v2026.2.0
v2026.2.0-latest
v2026.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-32620.json"