CVE-2026-32618: Discourse: Unauthorized channel membership inference via excluded_memberships_channel_id
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32618?
CVE-2026-32618 has a medium severity rating due to the unauthorized inference of channel memberships.
How do I fix CVE-2026-32618?
To fix CVE-2026-32618, upgrade Discourse to version 2026.1.3, 2026.2.2, or later.
What versions of Discourse are affected by CVE-2026-32618?
Versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 are affected by CVE-2026-32618.
What is the impact of CVE-2026-32618?
CVE-2026-32618 allows unauthorized users to infer channel memberships, potentially compromising user privacy.
Is there a workaround for CVE-2026-32618?
There is no known workaround for CVE-2026-32618, and users are advised to apply the necessary updates.