CVE-2026-32618
Unauthorized Channel Membership Inference in Discourse Chat Search
Publication date: 2026-03-31
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | 2026.3.0 |
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.3 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.2 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized inference of channel membership information in the Discourse chat platform, which can lead to limited exposure of user membership data without proper authorization.
Such unauthorized disclosure of user membership information could potentially impact compliance with data protection regulations like GDPR or HIPAA, which require safeguarding personal and sensitive information from unauthorized access or disclosure.
However, the confidentiality impact is rated as low, indicating limited data exposure, and the issue does not affect data integrity or availability.
Mitigations and patches have been released to prevent unauthorized access, which helps restore compliance by ensuring that membership information is only accessible to authorized users.
Can you explain this vulnerability to me?
CVE-2026-32618 is a vulnerability in the Discourse open-source discussion platform affecting certain versions before they were patched. It allows unauthorized users to infer which users belong to specific chat channels without having proper authorization.
The issue arises from the chat user search feature, specifically when using the parameter "excluded_memberships_channel_id". Previously, the system did not verify if the user performing the search had permission to view the specified chat channel. This lack of access control allowed attackers to deduce channel membership information by analyzing search results.
The vulnerability has a moderate severity with a CVSS v3.1 base score of 4.3, indicating it is relatively easy to exploit remotely with low privileges and no user interaction required.
How can this vulnerability impact me? :
This vulnerability can impact you by exposing information about which users are members of private chat channels without proper authorization.
An attacker with low privileges can remotely exploit this issue to infer channel membership, potentially revealing sensitive group affiliations or communication structures within your organization.
While the confidentiality impact is considered low and there is no impact on data integrity or availability, unauthorized disclosure of membership information could lead to privacy concerns or targeted social engineering attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing whether unauthorized users can infer channel membership information through chat user searches using the parameter "excluded_memberships_channel_id".
Specifically, you can attempt to perform a chat user search request that includes the "excluded_memberships_channel_id" parameter with a channel ID and observe if the search results exclude members of that channel without proper authorization.
If unauthorized users receive filtered search results that exclude members of a specific channel, it indicates the vulnerability is present.
There are no explicit commands provided in the resources, but a possible approach is to use HTTP request tools (e.g., curl) to simulate chat user search API calls with and without the "excluded_memberships_channel_id" parameter and analyze the responses for unauthorized filtering.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting the "chat_allowed_groups" setting to trusted groups only, limiting who can access chat features.
Alternatively, you can disable the chat feature entirely by setting "SiteSetting.chat_enabled" to false.
The definitive fix is to upgrade Discourse to one of the patched versions: 2026.1.3, 2026.2.2, or 2026.3.0, where the vulnerability has been addressed by adding proper permission checks.