CVE-2026-32099
Information Disclosure via Onebox Preview in Discourse User Profiles
Publication date: 2026-03-19
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Discourse open-source discussion platform. Before certain fixed versions, when a user enabled the 'hide_profile' setting to keep their bio, location, and website private, these fields were still exposed through the user onebox preview feature. An authenticated user could request a onebox preview of a hidden user's profile URL and receive the hidden profile information in the response, thus bypassing the privacy setting.
How can this vulnerability impact me? :
This vulnerability can lead to unintended disclosure of personal information such as bio, location, and website of users who intended to keep this information hidden. An authenticated user could access private profile details of other users, potentially compromising user privacy and trust in the platform.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Discourse installation to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.
No known workarounds are available, so applying the update is the recommended immediate step.