PT-2026-26549 · Discourse · Discourse

Jomaxr · Publicado 2026-03-20 · Atualizado 2026-03-27 · CVE-2026-32114

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Before versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an Insecure Direct Object Reference (IDOR) exists, allowing any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics that are not intended to be public. The attack is conducted over the network, requiring low privileges (any logged-in user), and results in a low impact on confidentiality.

Recommendations Versions prior to 2026.3.0-latest.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.2.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.1.2: Disable the AI plugin or upgrade to a patched version.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

BIT-DISCOURSE-2026-32114

CVE-2026-32114

GHSA-3CVR-PM4C-HX96

Produtos afetados

Discourse

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32114.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32114 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32114 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-discourse-2026-32114 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034841423418466445 · Publicação no Twitter