CVE-2026-32114: Discourse's unscoped status lookups leak restricted metadata
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics which are not intended to be public. The attack is performed over the network, requires low privileges (any logged-in user), and results in a low impact on confidentiality with no impact on integrity or availability. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, disable AI plugin or upgrade to a patched version.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32114?
CVE-2026-32114 is classified as a moderate severity vulnerability due to its potential to leak restricted metadata.
How do I fix CVE-2026-32114?
To fix CVE-2026-32114, upgrade your Discourse installation to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later.
Who is affected by CVE-2026-32114?
CVE-2026-32114 affects all users of Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
What type of vulnerability is CVE-2026-32114?
CVE-2026-32114 is an Insecure Direct Object Reference (IDOR) vulnerability.
What kind of data can be leaked by CVE-2026-32114?
CVE-2026-32114 can leak restricted metadata about AI features accessible to authenticated users.