What is the CVSS score of EUVD-2026-17559?

EUVD-2026-17559 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-17559?

Yes, a patch is available for EUVD-2026-17559. Update the affected software to the latest version immediately.

Discourse EUVD-2026-17559

| CVE-2026-32620 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 5.3 score reflects low confidentiality impact (VC:L) via network attack (AV:N) with low complexity (AC:L) requiring authenticated access (PR:L). The vulnerability requires legitimate login credentials but no complex exploitation steps. While the CVSS score is moderate, real-world risk is constrained: only metadata is exposed (not post content), the attacker must be an authenticated user, and the leaked information is limited to read receipt timing and viewer identity. This is a privilege escalation issue rather than a critical data breach vector. No active exploitation data (KEV status, POC availability) was provided in input. The automated disclosure risk is moderate since the attack vector is network-accessible and repeatable, but depends on user enumeration and staff post discovery within the Discourse instance.
Exploit ScenarioDerived	A non-staff user with a legitimate account on a Discourse instance logs in and crafts API or UI requests to retrieve read receipt data for staff-only posts in categories they cannot access. By enumerating post identifiers or leveraging information leakage from search results, the attacker discovers which staff members have viewed sensitive discussions and when, potentially exposing internal decision-making timelines or staff activity patterns. This scenario requires authenticated access but no elevated privileges, making it accessible to any registered user.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 31, 2026

Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 leak read receipt metadata (who read staff-only posts and when) to non-staff users who should not have access to that information. While no post content is exposed, the metadata disclosure violates intended access controls. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.

RemediationAI

Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 or later, depending on which release branch is in use. These versions include the access control fix that restricts read receipt metadata to authorized staff users. Administrators should review their Discourse instance version via the admin dashboard and apply the appropriate patch immediately. Detailed patch information and migration guidance are available in the GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-xgg2-vwr6-2c65. The upstream fix commit is available at https://github.com/discourse/discourse/commit/bf8dbf6155ae483245d42a0164181bc226af674d.

Affected VersionsENISA

discourse 2026.2.0-latest, < 2026.2.2

discourse 2026.1.0-latest, < 2026.1.3

discourse 2026.3.0-latest, < 2026.3.0

Affected Packages

euvd discourse_2026_1_0_latest fix: 2026.1.3

euvd discourse_2026_2_0_latest fix: 2026.2.2

euvd discourse_2026_3_0_latest fix: 2026.3.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 3 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Discourse is an open-source discussion and community platform built on Ruby on Rails. The vulnerability involves a broken access control in the read receipt functionality-a feature that tracks when users view posts. The underlying issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application fails to properly restrict metadata queries based on user privilege levels. The read receipt system queries and returns timing and user identity information without adequately verifying that the requesting user has staff privileges required to view staff-only post engagement metrics. This affects all Discourse instances running the vulnerable version ranges across multiple release branches.

Know when Discourse gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

None

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.1.3,2026.3.0

CVE Published

Mar 31, 2026 - 17:41 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.