Is there a patch available for CVE-2026-32619?

Yes, a patch is available for CVE-2026-32619. Update the affected software to the latest version immediately.

Discourse CVE-2026-32619

Q: What is the CVSS score of CVE-2026-32619?

CVE-2026-32619 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17557 MEDIUM

Improper Authorization (CWE-285)

2026-03-31 GitHub_M

Authentication Bypass Discourse

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.3.0,2026.1.3

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17557

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:40 nvd

MEDIUM 6.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, users who lost access to a topic (e.g., removed from a private category group) could still interact with polls in that topic, including voting and toggling poll status. No content was exposed, but users could modify poll state in topics they should no longer have access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0-beta retain unauthorized poll interaction capabilities for users who have lost access to private topics, allowing them to vote on and toggle poll status despite removal from category group membership. While no topic content is exposed, the vulnerability permits state modification in topics to which access should have been revoked, violating the intended access control model. Patched versions 2026.1.3, 2026.2.2, and 2026.3.0 are available, and no public exploit code has been identified.

Technical ContextAI

This is an access control enforcement failure (CWE-285) in Discourse's poll endpoint authorization logic. When users are removed from a private category group, their general access tokens may remain valid for certain API endpoints. The vulnerability stems from insufficient re-verification of category membership permissions at the poll interaction endpoint-specifically vote submission and poll status toggle operations. Unlike topic view access, which likely re-checks group membership dynamically, the poll endpoints use cached or stale authorization state. The affected CPE (cpe:2.3:a:discourse:discourse) spans the open-source discussion platform core, indicating the flaw exists in the primary product rather than a plugin or extension.

RemediationAI

Upgrade Discourse to version 2026.1.3 (for 2026.1.x instances), 2026.2.2 (for 2026.2.x instances), or 2026.3.0 or later (for 2026.3.x instances). These patched versions enforce authorization checks at the poll interaction endpoint to verify current category group membership. The upstream fix is committed at https://github.com/discourse/discourse/commit/d74ff25db994f06aa27e3466684f613b4e986ba6. No workarounds are available prior to patching; administrators should prioritize upgrades for instances with active private category discussions involving polls. See the GitHub security advisory for deployment guidance.