What is the CVSS score of CVE-2026-32618?

CVE-2026-32618 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32618?

Yes, a patch is available for CVE-2026-32618. Update the affected software to the latest version immediately.

Discourse CVE-2026-32618

EUVD-2026-17555 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.3.0,2026.2.2

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17555

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:40 nvd

MEDIUM 4.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse chat user search functionality discloses channel membership information to authenticated users without proper authorization checks, allowing users to infer private channel membership across versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-rc1, affecting community administrators and organizations relying on channel privacy. The vulnerability requires authenticated access but carries low confidentiality impact (CVSS 4.3); patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Technical ContextAI

Discourse is a Ruby on Rails-based discussion platform that includes integrated chat functionality with channel membership controls. The vulnerability exists in the chat user search endpoint, which fails to enforce proper authorization filters when returning search results. Under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), the search API returns user profiles or activity indicators that indirectly reveal membership in restricted channels, bypassing the platform's channel access control model. The issue affects all patch levels of the three active release branches (2026.1.x, 2026.2.x, 2026.3.x) distributed via the primary Discourse repository.

RemediationAI

Upgrade to patched versions: Discourse 2026.1.3 for the 2026.1.x branch, Discourse 2026.2.2 for the 2026.2.x branch, or Discourse 2026.3.0 or later for the 2026.3.x branch. For organizations unable to patch immediately, restrict user search permissions via Discourse admin settings to limit exposure; however, this is a mitigation only and not a substitute for patching. See the vendor security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3 and the commit fix at https://github.com/discourse/discourse/commit/81fd89e744058e509412158e5e6ac90c856ade64 for implementation details.