Discourse CVE-2026-32951

The CVSS score of 4.3 reflects low-to-medium severity: the attack vector is network (AV:N) and requires low complexity (AC:L), but critically requires an authenticated login (PR:L), and the impact is confined to confidentiality only (C:L; no integrity or availability impact). The severity is further bounded by the attack requiring knowledge of the shared drafts category ID and understanding the onebox endpoint structure. However, this is not a high-real-world-risk vulnerability for most Discourse instances because exploitation requires valid user credentials-an insider threat rather than an external attacker profile. EPSS and KEV data show no public POC or active exploitation at time of analysis. The primary concern is information disclosure to authenticated insiders, which ranks lower than remote unauthenticated attack vectors in typical risk frameworks. For instances with sensitive draft workflows or strict confidentiality requirements, remediation is recommended; for general-purpose forums, this is a routine patch rather than a critical emergency.

An authenticated regular user with valid Discourse credentials discovers the inline onebox endpoint and observes that requests accept a category_id parameter. The user obtains or guesses the numeric ID of the shared drafts category (often a lower number in typical Discourse setups) and sends a crafted onebox request with that category_id. The vulnerable endpoint returns a preview containing the title of one or more draft topics, leaking sensitive information such as unreleased announcements or unvetted policy changes that the attacker should not access. The attacker needs only network access to the Discourse instance and valid login credentials, both readily available in organizations with open-signup forums.