What is the CVSS score of CVE-2026-32244?

CVE-2026-32244 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32244?

Yes, a patch is available for CVE-2026-32244. Update the affected software to the latest version immediately.

Discourse CVE-2026-32244

EUVD-2026-30815 MEDIUM

Information Exposure (CWE-200)

2026-05-19 security-advisories@github.com

Information Disclosure Discourse

5.3

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 19, 2026 - 01:01 EUVD

Analysis Generated

May 19, 2026 - 00:27 vuln.today

DescriptionCVE.org

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. To work around this issue, restrict summary generation by tightening the allowed groups on the summarization Personas.

AnalysisAI

Discourse's AI summarization feature exposes removed or restricted content to anonymous and unprivileged users through stale cached summaries. Affected are all Discourse instances running versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 with AI summarization enabled. An unauthenticated attacker can read cached summaries that persist after the underlying content has been moderated or deleted, bypassing content removal controls. No public exploit code exists and no KEV listing has been issued at time of analysis.

Technical ContextAI

Discourse is an open-source Ruby-on-Rails-based community discussion platform with an integrated AI summarization layer that generates and caches topic or post summaries via configurable 'summarization Personas.' The vulnerability stems from CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): when content is removed by moderators or administrators, the AI-generated summary cache is not invalidated, leaving a stale representation of the removed content accessible. Because summaries are served to anonymous and low-privilege users who lack the ability to trigger summary regeneration, those users receive a cached view that reflects content the platform has since redacted. The root cause is a cache-coherency failure between the content moderation lifecycle and the AI summary invalidation logic.

RemediationAI

Upgrade Discourse to one of the vendor-confirmed fixed releases: stable branch 2026.1.4, beta branch 2026.3.1, tests-passed branch 2026.4.1, or latest branch 2026.5.0-latest.1. Full advisory and upgrade guidance are available at https://github.com/discourse/discourse/security/advisories/GHSA-hjmg-2mww-vfvx. For operators who cannot immediately upgrade, the vendor-documented workaround is to restrict summary generation by tightening the allowed groups on the summarization Personas - limiting which user groups can trigger summary creation prevents fresh summaries from being cached for broad audiences, and reduces the surface area for stale summaries to be exposed. Note that this workaround does not retroactively invalidate existing cached summaries; operators should consider manually purging the AI summary cache after applying group restrictions. Disabling the AI summarization feature entirely eliminates the vulnerability at the cost of losing summarization functionality.