Is there a patch available for EUVD-2026-17559?

Yes, a patch is available for EUVD-2026-17559. Update the affected software to the latest version immediately.

Discourse EUVD-2026-17559

Q: What is the CVSS score of EUVD-2026-17559?

EUVD-2026-17559 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-32620 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.1.3,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17559

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:41 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0 through 2026.1.2, 2026.2.0 through 2026.2.1, and 2026.3.0 leak read receipt metadata (who read staff-only posts and when) to non-staff users who should not have access to that information. While no post content is exposed, the metadata disclosure violates intended access controls. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Technical ContextAI

Discourse is an open-source discussion and community platform built on Ruby on Rails. The vulnerability involves a broken access control in the read receipt functionality-a feature that tracks when users view posts. The underlying issue is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the application fails to properly restrict metadata queries based on user privilege levels. The read receipt system queries and returns timing and user identity information without adequately verifying that the requesting user has staff privileges required to view staff-only post engagement metrics. This affects all Discourse instances running the vulnerable version ranges across multiple release branches.

RemediationAI

Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 or later, depending on which release branch is in use. These versions include the access control fix that restricts read receipt metadata to authorized staff users. Administrators should review their Discourse instance version via the admin dashboard and apply the appropriate patch immediately. Detailed patch information and migration guidance are available in the GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-xgg2-vwr6-2c65. The upstream fix commit is available at https://github.com/discourse/discourse/commit/bf8dbf6155ae483245d42a0164181bc226af674d.