What is the CVSS score of CVE-2026-32951?

CVE-2026-32951 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-32951?

Yes, a patch is available for CVE-2026-32951. Update the affected software to the latest version immediately.

Discourse CVE-2026-32951

EUVD-2026-17565 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

4.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.3.0,2026.2.2

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17565

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:41 nvd

MEDIUM 4.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated user can obtain shared draft topic titles by sending an inline onebox request with a category_id parameter matching the shared drafts category. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 prior to patching allow authenticated users to disclose shared draft topic titles via specially crafted inline onebox requests that reference the shared drafts category. An attacker with valid Discourse credentials can enumerate and read draft titles not intended for their access, violating information confidentiality. The vulnerability has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0; EPSS and KEV data indicate no current active exploitation, though the fix is available and should be deployed promptly given the low barrier to exploitation.

Technical ContextAI

Discourse is a Ruby-on-Rails-based forum and discussion platform that uses inline onebox functionality to generate previews of linked content. The vulnerability exists in the onebox request handler, which accepts a category_id parameter without proper authorization checks. When an authenticated user sends an inline onebox request with the category_id pointing to the shared drafts category, the application leaks the title of draft topics stored in that category. Shared drafts in Discourse are a feature allowing moderators and administrators to collaborate on topics before public posting, and titles should not be readable by users lacking the appropriate access grants. The root cause falls under CWE-200 (Information Exposure), specifically a failure to enforce access controls on category content when processing preview/preview-generation requests.

RemediationAI

Upgrade Discourse to patched versions 2026.1.3, 2026.2.2, or 2026.3.0 or later, depending on the currently deployed release track. The fix is available in upstream commit 0b4e6ff170362823d1cfe2a1a096785d0d77ee83. Instances should prioritize this patch during routine maintenance windows. No workaround short of upgrading is available; organizations requiring immediate mitigation before patching should restrict access to draft topics to administrators only through role-based access controls, though this may disrupt collaborative draft workflows.