Discourse CVE-2026-32143

The CVSS 5.3 score reflects a network-accessible vulnerability requiring low privileges (authenticated moderator account) with low confidentiality impact and no integrity or availability impact. The CVSS vector (AV:N/AC:L/PR:L) confirms remote, unauthenticated attackers cannot exploit this-it requires a valid moderator account. Real-world risk is moderate but contextualized: (1) Exploitation requires insider access (someone with moderator role), reducing external threat surface; (2) The data exposed is operational/administrative in nature (e.g., user reports, analytics) rather than user credentials or payment data, limiting downstream harm; (3) Patch availability is confirmed in multiple versions, enabling rapid remediation. However, organizations with large moderator populations or those where moderators lack sufficient vetting face higher risk. This is a legitimate privilege escalation within a trusted user base, not a critical external vulnerability, but should be prioritized for patching in instances with sensitive report data.

An authenticated Discourse moderator with standard report-viewing privileges navigates to an admin-restricted report (e.g., monthly user suspension analytics or abuse complaint summaries) and selects the CSV export option. Due to the missing authorization check, the export succeeds despite the report being flagged as admin-only, returning sensitive operational data that the moderator should not access. The moderator downloads the CSV and retains a local copy, potentially sharing it outside the organization or using it for competitive advantage. No public exploit code is referenced in available data, but exploitation is trivial for any account with moderator role-the attack vector is network-accessible and requires only a single click. This scenario is plausible in organizations where moderator roles are assigned to community volunteers or junior staff without full administrative oversight.