CVE-2026-32615: Discourse: Category group moderators can perform actions on topics in restricted categories without read access
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, category group moderators could perform privileged actions on topics inside private categories they did not have read access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32615?
CVE-2026-32615 is a moderate severity vulnerability allowing category group moderators to perform actions on restricted topics without necessary read access.
How do I fix CVE-2026-32615?
To fix CVE-2026-32615, update Discourse to version 2026.1.3 or 2026.2.2 or later.
What versions of Discourse are affected by CVE-2026-32615?
CVE-2026-32615 affects Discourse versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0.
Who can exploit CVE-2026-32615?
Category group moderators with access to restricted categories can exploit CVE-2026-32615 to manage topics without proper permissions.
What impact does CVE-2026-32615 have on Discourse users?
The impact of CVE-2026-32615 includes unauthorized access to restricted content, potentially compromising user privacy and data security.