Is there a patch available for CVE-2026-32143?

Yes, a patch is available for CVE-2026-32143. Update the affected software to the latest version immediately.

Discourse CVE-2026-32143

Q: What is the CVSS score of CVE-2026-32143?

CVE-2026-32143 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17548 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.3.0,2026.2.2,2026.1.3

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17548

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:39 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse moderators can export CSV data from admin-restricted reports in versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-beta, circumventing role-based access controls and exposing sensitive operational data intended exclusively for administrators. The vulnerability requires authenticated moderator access but carries low confidentiality impact (CVSS 5.3). Vendor-released patches are available in Discourse 2026.1.3, 2026.2.2, and 2026.3.0.

Technical ContextAI

This vulnerability stems from inadequate access control enforcement in Discourse's report export functionality (CWE-200: Information Exposure). The application fails to properly validate authorization when moderators request CSV exports of reports classified as admin-only. While the underlying framework may enforce role-based access control at the UI layer, the CSV export endpoint does not replicate these checks, allowing a moderator with PR:L (low privilege level) to retrieve data that should be gated to administrators only. The issue affects the Discourse open-source discussion platform across multiple minor versions in the 2026 release cycle, indicating a regression or missing authorization check introduced during feature development.

RemediationAI

Upgrade to Discourse 2026.1.3, 2026.2.2, or 2026.3.0 (or later) depending on your current version branch. Vendor-released patches are confirmed available in all three versions. If immediate patching is not feasible, restrict moderator permissions to exclude report export functionality, or audit recent CSV exports from moderator accounts to detect unauthorized data access. Apply the upstream fix commit 727029a2983a14b50bce19439fbf9840db8372aa if manually integrating patches. Refer to https://github.com/discourse/discourse/security/advisories/GHSA-rhjf-mgqw-37wq for vendor guidance and deployment notes.