CVE-2026-32143: Discourse: Admin-only report can be exported by moderators
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32143?
CVE-2026-32143 is considered a moderate severity vulnerability due to improper access controls allowing moderators to export admin-restricted reports.
How do I fix CVE-2026-32143?
To fix CVE-2026-32143, upgrade your Discourse installation to version 2026.1.3, 2026.2.2, or later.
Which versions of Discourse are affected by CVE-2026-32143?
Discourse versions 2026.1.0 to 2026.1.2, 2026.2.0 to 2026.2.1, and 2026.3.0 are affected by CVE-2026-32143.
What type of vulnerability is CVE-2026-32143?
CVE-2026-32143 is an access control vulnerability allowing unauthorized data exportation.
Who can exploit CVE-2026-32143?
Moderators with access to the Discourse platform can exploit CVE-2026-32143 to export admin-only reports.