CVE-2026-32244

MediumCVSS 5.3/10Last modified Jul 24, 2026

Description

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. To work around this issue, restrict summary generation by tightening the allowed groups on the summarization Personas.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-524 CWE-672

Affected software

Vendor	Product	Versions
discourse	discourse	< 2026.1.4; >= 2026.3.0-latest, < 2026.3.1; >= 2026.4.0-latest, < 2026.4.1; >= 2026.5.0-latest, < 2026.5.0-latest.1

References

https://github.com/discourse/discourse/security/advisories/GHSA-hjmg-2mww-vfvxMitigation, Vendor Advisory

Timeline

Published: May 19, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-322456.5Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the client exchanging a CVE-2026-322467.1Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users with a TOTP-pending ses CVE-2026-322478.1Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher CVE-2026-322489.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, CVE-2026-322495.5Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encountering a collection CVE-2026-32254.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing CVE-2026-322504.3NamelessMC is website software for Minecraft servers. A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in version 2.2.4 i CVE-2026-322516.5Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resources (.xml) and .resx CVE-2026-322527.7Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.CVE-2026-322539.8Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be CVE-2026-322547.1Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not validate externalIP CVE-2026-322558.6Kan is an open-source project management tool. In versions 0.5.4 and below, the /api/download/attatchment endpoint has no authentication and