PT-2026-26549 · Discourse · Discourse

Jomaxr · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-32114

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.3.0-latest.1 Discourse versions prior to 2026.2.1 Discourse versions prior to 2026.1.2

Description Discourse is an open-source discussion platform. Before versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an Insecure Direct Object Reference (IDOR) exists, allowing any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics that are not intended to be public. The attack is conducted over the network, requiring low privileges (any logged-in user), and results in a low impact on confidentiality.

Recommendations Versions prior to 2026.3.0-latest.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.2.1: Disable the AI plugin or upgrade to a patched version. Versions prior to 2026.1.2: Disable the AI plugin or upgrade to a patched version.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BIT-DISCOURSE-2026-32114

CVE-2026-32114

GHSA-3CVR-PM4C-HX96

Affected Products

Discourse

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32114.json · Exploit
• https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32114 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32114 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-discourse-2026-32114 · Vendor Advisory
• https://twitter.com/CVEnew/status/2034841423418466445 · Twitter Post