CVE-2026-32618 discourse CVE debrief

Who should care

Users of Discourse, especially those with chat functionality enabled, should be aware of this vulnerability and ensure they are running a patched version. This includes administrators and security teams responsible for maintaining Discourse installations, as well as users who engage with chat features and may be impacted by channel membership inference.

Technical summary

The vulnerability in Discourse arises from inadequate authorization in the chat user search functionality. This allows an attacker to infer channel membership without proper permissions. The issue has been addressed with patches in the specified versions. Affected versions include 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. The patches have been applied in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Defensive priority

Medium priority due to the potential for privacy implications and the availability of patches.

Recommended defensive actions

• Inventory and verify Discourse versions, ensuring 2026.1.3, 2026.2.2, or 2026.3.0 or later are deployed.
• Implement compensating controls such as monitoring for unusual chat activity.
• Exception tracking for unauthorized access attempts.
• Retest environment after applying patches.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is based on official CVE and NVD records, as well as vendor advisories from Discourse. The CVE record was published on 2026-03-31T18:16:50.370Z and was last modified on 2026-07-24T20:10:00.147Z. Additional verification tasks include reviewing the official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources