CVE-2026-32615
Privilege Escalation in Discourse Category Group Moderators
Publication date: 2026-03-31
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | 2026.3.0 |
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.3 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.2 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability CVE-2026-32615, you should upgrade your Discourse installation to one of the patched versions.
- Upgrade to Discourse version 2026.1.3 or later if you are using the 2026.1.x series.
- Upgrade to Discourse version 2026.2.2 or later if you are using the 2026.2.x series.
- Upgrade to Discourse version 2026.3.0 or later if you are using the 2026.3.x series.
These updates patch the issue where category group moderators could perform privileged actions on topics inside private categories without having read access.
Can you explain this vulnerability to me?
CVE-2026-32615 is a vulnerability in the Discourse open-source discussion platform affecting certain versions before 2026.1.3, 2026.2.2, and 2026.3.0. It allows category group moderators to perform privileged actions on topics inside private categories to which they do not have read access. Essentially, moderators could manipulate content in restricted areas they are not authorized to view.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows category group moderators to perform privileged actions on topics inside private categories they do not have read access to, effectively bypassing intended access controls.
Such unauthorized access and manipulation of private content could lead to violations of data privacy and confidentiality requirements mandated by regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.
Therefore, until patched, this vulnerability could negatively impact compliance with these common standards by exposing private data to unauthorized users.
Upgrading to the patched versions (2026.1.3, 2026.2.2, and 2026.3.0) is necessary to restore proper access controls and maintain compliance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves category group moderators performing privileged actions on topics inside private categories without having read access. Detection would primarily involve verifying the version of the Discourse software in use and monitoring for unauthorized privileged actions by moderators in private categories.
To detect if your system is vulnerable, check the Discourse version installed. Versions from 2026.1.0 up to but not including 2026.1.3, 2026.2.0 up to but not including 2026.2.2, and 2026.3.0 before the patch are affected.
Suggested commands to check the Discourse version might include:
- Access the Discourse server and run: `cd /var/discourse && ./launcher enter app && discourse version` (or the equivalent command depending on your installation) to retrieve the current Discourse version.
- Review Discourse logs for unusual moderator actions in private categories, which might require custom log parsing or monitoring tools.
Since the vulnerability is related to application logic and permissions, network-level detection commands are not directly applicable.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing category group moderators to perform actions on private or restricted topics without proper authorization. This could lead to unauthorized content manipulation, potentially compromising the integrity and confidentiality of discussions within private categories.