CVE-2026-32143

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, moderators could export CSV data for admin-restricted reports, bypassing the report visibility restrictions. This could expose sensitive operational data intended only for admins. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-321447.4Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization b CVE-2026-321457.5Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body par CVE-2026-321467.8Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification during CVE-2026-321474.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an CVE-2026-321485.9Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass vi CVE-2026-321497.3Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-32155.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site Scr CVE-2026-321507.0Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows CVE-2026-321516.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a net CVE-2026-321527.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-321537.8Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.CVE-2026-321547.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.