Is there a patch available for CVE-2026-32615?

Yes, a patch is available for CVE-2026-32615. Update the affected software to the latest version immediately.

Discourse CVE-2026-32615

Q: What is the CVSS score of CVE-2026-32615?

CVE-2026-32615 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17553 MEDIUM

Improper Authorization (CWE-285)

2026-03-31 GitHub_M

Authentication Bypass Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.3.0,2026.1.3

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17553

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:40 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Category group moderators in Discourse versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-pre can perform privileged actions (such as topic moderation) on content within private categories to which they lack read access, bypassing intended access controls. This authenticated privilege escalation affects self-hosted and managed Discourse instances and has been resolved in versions 2026.1.3, 2026.2.2, and 2026.3.0+. No public exploit code or active exploitation has been reported at this time.

Technical ContextAI

Discourse implements role-based access control (RBAC) through category-level permissions and group moderator roles. The vulnerability stems from an insufficient authorization check (CWE-285: Improper Authorization) in the moderator action handler-specifically, the platform fails to verify that a category group moderator possesses read access to a private category before permitting them to execute moderation operations (topic lock, delete, move, etc.) on topics within that category. This creates a logic flaw where group membership confers moderator capabilities without first validating the prerequisite read permission, allowing authenticated users with moderator role assignment to access and manipulate content they should not be able to view. The fix (commit 5a00b47) likely adds an explicit read-access permission check before any moderator action is executed.

RemediationAI

Upgrade immediately to patched versions: 2026.1.3, 2026.2.2, or 2026.3.0 and later depending on the currently deployed major version track. Users unable to upgrade immediately should audit category group moderator assignments in private categories to ensure moderators have legitimate read access to those categories; remove moderator role from users who should not have access to the category's content. For detailed instructions and verification steps, consult the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-pr9m-5hpq-wc57 and the upstream fix commit at https://github.com/discourse/discourse/commit/5a00b47523ec70cbb6e8efc3ac7677cc0a91448b.