VYPR
Get started
← All advisories
Medium severity6.5NVD Advisory· Published Mar 31, 2026· Updated Apr 9, 2026

CVE-2026-32143

CVE-2026-32143

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Affected products

3
  • Discourse (software)/Discourse3 versions
    cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*+ 2 more
    • cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*
    • cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:*
    • cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*range: >=2026.1.0,<2026.1.3

Patches

1
727029a2983a
https://github.com/discourse/discoursevia nvd-ref
commit

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

2

News mentions

0

No linked articles in our index yet.