CVE-2026-32620: Discourse: Missing post-level authorization allows whisper metadata disclosure
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, non-staff users could access read receipt information for staff-only posts they weren't supposed to see. No post content was exposed, only metadata about who read the post and when. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
Discourseto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32620?
The severity of CVE-2026-32620 is considered moderate as it allows unauthorized disclosure of sensitive metadata.
How do I fix CVE-2026-32620?
To fix CVE-2026-32620, upgrade Discourse to version 2026.1.3 or later, or 2026.2.2 or later, or 2026.3.0 or later.
Who is affected by CVE-2026-32620?
Non-staff users of Discourse versions 2026.1.0 to 2026.1.2, 2026.2.0 to 2026.2.1, and up to 2026.3.0 are affected by CVE-2026-32620.
What kind of information is disclosed by CVE-2026-32620?
CVE-2026-32620 allows unauthorized users to access read receipt information, which is considered sensitive metadata.
Is CVE-2026-32620 a zero-day vulnerability?
CVE-2026-32620 is not a zero-day vulnerability as it has been publicly disclosed and a fix is available.