CVE Explorer
CVE-2026-32114
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics which are not intended to be public. The attack is performed over the network, requires low privileges (any logged-in user), and
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"discourse","vendor":"discourse","versions":[{"status":"affected","version":">= 2026.1.0-latest, < 2026.1.2"},{"status":"affected","version":">= 2026.2.0-latest, < 2026.2.1"},{"status":"affected","version":"= 2026.3.0-latest"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:9972b6ec5a898ce41d101ceac16d1e6e7afc8821e165df7b8adf77934457bf62 · sha256:7cfad4f8d5983fbc… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.3,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE"},"metric_type":"cvssV4_0"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:9972b6ec5a898ce41d101ceac16d1e6e7afc8821e165df7b8adf77934457bf62 · sha256:7cfad4f8d5983fbc… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-639","description":"CWE-639: Authorization Bypass Through User-Controlled Key","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:9972b6ec5a898ce41d101ceac16d1e6e7afc8821e165df7b8adf77934457bf62 · sha256:7cfad4f8d5983fbc… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"name":"https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96","tags":["x_refsource_CONFIRM"],"url":"https://github.com/discourse/discourse/security/advisories/GHSA-3cvr-pm4c-hx96"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:9972b6ec5a898ce41d101ceac16d1e6e7afc8821e165df7b8adf77934457bf62 · sha256:7cfad4f8d5983fbc… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.