CVE-2026-32618

תיאור (מקור, אנגלית)

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, there is possible channel membership inference from chat user search without authorization. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

מדדים

CVSS 3.1

4.3 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-27/7/2026

CWE

CWE-200

מוצרים מושפעים

discourse: discourse

קישורים

• https://github.com/discourse/discourse/security/advisories/GHSA-pc8p-w2m7-hgf3 Vendor Advisory
• https://github.com/discourse/discourse/commit/81fd89e744058e509412158e5e6ac90c‮… Patch