Discourse CVE-2026-32244

The AI summarization feature must be enabled on the Discourse instance, which requires explicit administrator configuration including a third-party AI API key - this is not enabled in default Discourse installations. A summary must have been generated for a given topic prior to the content removal event. Exploitation is limited to reading summarized text only, not full post content, attachments, or user data. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required once those preconditions exist. Exploitation is constrained to instances with AI summarization active and only affects topics for which cached summaries predate a moderation action.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores this at 5.3 Medium. Attack complexity is low and no authentication is required, meaning any anonymous internet user can attempt to read stale summaries. However, the confidentiality impact is rated Low (C:L), reflecting that only summary text - not raw posts, attachments, or account data - is exposed, and only for topics that had AI summaries generated prior to content removal. EPSS data was not provided; the absence of KEV listing and public POC code suggests this is not actively targeted at scale. Real-world risk is bounded by two factors: the deploying instance must have AI summarization enabled (a non-default, optional feature requiring API key configuration), and exploitation yields only partial, summarized content rather than full post bodies or sensitive metadata. This is a genuine but contained information disclosure - a real priority for communities where removed content may be sensitive (e.g., legal disputes, private forum content), but not an emergency for most deployments without AI features enabled.

An anonymous user visits a Discourse forum where a topic containing sensitive content (e.g., a private dispute, a post later removed by moderators) had previously had an AI summary generated. After a moderator deletes the offending post, the cached summary remains accessible. The anonymous user fetches the topic's summary endpoint and receives the stale AI-generated text that references or reproduces the removed content. No public exploit code exists, and the attack requires no tooling beyond a standard web browser or HTTP client.