CVE-2026-32099

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has `hide_profile` enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's profile URL and receive their hidden profile fields (bio, location, website) in the response. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
discoursediscourse>= 2026.1.0-latest, < 2026.1.2; >= 2026.2.0-latest, < 2026.2.1; = 2026.3.0-latest

References

Timeline

Published
Mar 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-32105.3Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 beforeCVE-2026-321005.3Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed CVE-2026-321016.3StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorizedCVE-2026-321026.5OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts exCVE-2026-321037.2StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/creCVE-2026-321045.4StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint CVE-2026-321057.7xrdp is an open source RDP server. In versions through 0.10.5, xrdp does not implement verification for the Message Authentication Code (MACCVE-2026-321067.2StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the REST API createUser endpoint usesCVE-2026-321078.8xrdp is an open source RDP server. In versions through 0.10.5, the session execution component did not properly handle an error during the pCVE-2026-321086.5Copyparty is a portable file server. Prior to 1.20.12, there was a missing permission-check in the shares feature (the shr global-option). TCVE-2026-321094.4Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they caCVE-2026-32114.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Th
CVE-2026-32099: Medium severity, CVSS 6.5 | Vulnix