Discourse CVE-2026-32615

The CVSS 5.3 score reflects low-to-medium severity: the attack requires authentication (PR:L), network access (AV:N), and no user interaction, yielding limited confidentiality and integrity impact (VC:L, VI:L) with no availability impact. The SSVC perspective rates this as moderate: exploitation is straightforward (standard Discourse API calls), the impact is limited to unauthorized topic modification within a specific role context, and remediation is simple patching. While not critical, this is a real authorization bypass that could allow moderators to censor, delete, or tamper with discussions in private categories, potentially violating governance policies and user trust. The rapid availability of patches across three version tracks suggests the vendor took the issue seriously. This is a genuine priority for administrators managing private category governance, but not an emergency-level incident.

An authenticated category group moderator assigned to moderate a private category (e.g., 'Staff Only') attempts to access a topic in that category via the Discourse web UI or API. Normally, the topic would be invisible because the moderator lacks read permission. However, due to the authorization flaw, the moderator can invoke moderation actions (lock, delete, move, or edit) on the topic without triggering a permission denial. A malicious moderator could use this to suppress sensitive discussions or manipulate private conversations, and a careless administrator could accidentally grant moderator role to a user on a private category, unaware the user would then gain access to all topics within it.