CVE-2026-32615: Discourse Privilege Escalation Vulnerability

CVE-2026-32615 Overview

CVE-2026-32615 is an Improper Authorization vulnerability affecting Discourse, an open-source discussion platform. The vulnerability allows category group moderators to perform privileged actions on topics inside private categories they do not have read access to, resulting in potential unauthorized data access and manipulation.

Critical Impact

Category group moderators can bypass access controls to perform privileged operations on topics within private categories, potentially compromising confidential discussions and sensitive data within affected Discourse installations.

Affected Products

• Discourse versions 2026.1.0-latest to before 2026.1.3
• Discourse versions 2026.2.0-latest to before 2026.2.2
• Discourse versions 2026.3.0-latest to before 2026.3.0

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-32615 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32615

Vulnerability Analysis

This vulnerability stems from improper authorization checks (CWE-285) in Discourse's category moderator permission system. The flaw allows authenticated users with category group moderator privileges to perform actions on topics within private categories even when they lack explicit read access to those categories.

The authorization bypass occurs because the permission validation logic fails to properly verify read access before allowing moderator actions. This creates a security gap where moderators can execute privileged operations on content they should not be able to view or interact with.

Root Cause

The root cause is an Improper Authorization (CWE-285) issue where the application fails to properly validate that category group moderators have the necessary read permissions before allowing them to perform privileged actions on topics. The authorization check sequence was flawed, allowing actions to proceed without complete access verification.

Attack Vector

An attacker with category group moderator privileges can exploit this vulnerability by:

1. Identifying private categories within the Discourse instance
2. Attempting to perform moderator actions on topics within those private categories
3. Bypassing the read access check to execute privileged operations such as editing, moving, or moderating topics they should not have access to

The attack requires network access and low-privilege authentication (category group moderator role), but no user interaction is needed to exploit the vulnerability.

       def show
         topic = Topic.find(params[:topic_id])
         guardian.ensure_can_see!(topic)
+        summarization_service = DiscourseAi::TopicSummarization.for(topic, current_user)
+        cached_summary = summarization_service.cached_summary
 
-        raise Discourse::NotFound if !guardian.can_see_summary?(topic)
+        if !guardian.can_see_summary?(topic, cached_summary: cached_summary)
+          raise Discourse::NotFound
+        end
 
         RateLimiter.new(current_user, "summary", 6, 5.minutes).performed! if current_user
 
         opts = params.permit(:skip_age_check)
         skip_age_check = opts[:skip_age_check] == "true"
 
-        summarization_service = DiscourseAi::TopicSummarization.for(topic, current_user)
-
         if params[:stream] && current_user
-          cached_summary = summarization_service.cached_summary
-
           if cached_summary && !skip_age_check
             render_serialized(cached_summary, AiTopicSummarySerializer)
             return

Source: GitHub Commit Log

Detection Methods for CVE-2026-32615

Indicators of Compromise

• Unusual moderator activity logs showing actions on private categories by users without explicit read access
• Access attempts to private category topics by category group moderators who are not members of those categories
• Audit trail entries showing topic modifications in restricted categories by unauthorized moderators

Detection Strategies

• Review Discourse admin logs for moderator actions performed on private categories
• Monitor for patterns of access attempts to restricted content by users with moderator roles
• Implement alerting for any moderator actions on topics where the user lacks category membership

Monitoring Recommendations

• Enable detailed audit logging for all moderator actions within Discourse
• Regularly review category permissions and moderator role assignments
• Configure alerts for suspicious access patterns involving private categories

How to Mitigate CVE-2026-32615

Immediate Actions Required

• Upgrade Discourse to patched versions: 2026.1.3, 2026.2.2, or 2026.3.0 immediately
• Review moderator actions on private categories since the vulnerable versions were deployed
• Audit category group moderator permissions to ensure principle of least privilege
• Review private category access logs for any unauthorized actions

Patch Information

Discourse has released patched versions that address this vulnerability. The fix ensures proper authorization checks are performed before allowing moderator actions on topics, verifying both read access and moderator permissions. The security patch is available in the following versions:

• Version 2026.1.3
• Version 2026.2.2
• Version 2026.3.0

For more details, see the GitHub Security Advisory and the commit implementing the fix.

Workarounds

• Temporarily revoke category group moderator privileges from users who do not require them
• Review and restrict access to private categories until patches can be applied
• Implement network-level access controls to limit exposure of Discourse admin interfaces

# Configuration example
# Update Discourse to the latest patched version using the launcher
cd /var/discourse
./launcher rebuild app

# Verify the installed version after update
./launcher enter app
rails runner "puts Discourse::VERSION::STRING"