CVE-2026-32619: Discourse: Insufficient topic visibility check allows unauthorized poll manipulation in private categories
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, users who lost access to a topic (e.g., removed from a private category group) could still interact with polls in that topic, including voting and toggling poll status. No content was exposed, but users could modify poll state in topics they should no longer have access to. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32619?
CVE-2026-32619 has been classified as a high severity vulnerability due to its potential for unauthorized poll manipulation.
How do I fix CVE-2026-32619?
To mitigate CVE-2026-32619, upgrade Discourse to version 2026.1.3 or 2026.2.2 or later.
Which versions of Discourse are affected by CVE-2026-32619?
CVE-2026-32619 affects Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and up to but not including 2026.3.0.
What kind of attack does CVE-2026-32619 allow?
CVE-2026-32619 allows unauthorized users to manipulate polls within private categories.
Are all Discourse installations vulnerable to CVE-2026-32619?
Not all, only Discourse installations running the affected versions prior to the security updates are vulnerable to CVE-2026-32619.