CVE-2026-32114: 
NixOS vulnerability analysis and mitigation

CVE-2026-32114 is an Insecure Direct Object Reference (IDOR) vulnerability in Discourse, the open-source discussion platform, affecting its AI plugin functionality. Any authenticated user can access restricted metadata about AI personas, features, and LLM models — including credit allocations and usage statistics — by supplying object identifiers in requests. Affected versions include Discourse 2026.1.0 through 2026.1.1, 2026.2.0, and 2026.3.0-latest (prior to latest.1). The vulnerability was published on March 20, 2026, with patches released shortly after. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), where the system's authorization logic fails to restrict access to AI-related metadata objects when a user supplies a valid identifier. An authenticated attacker can craft network requests that reference AI persona, feature, or LLM model identifiers directly — bypassing access controls — to retrieve metadata such as credit allocations and usage statistics. No special privileges beyond a standard logged-in account are required, and no user interaction from a victim is needed. The vulnerability resides specifically in the Discourse AI plugin's status lookup endpoints, which perform unscoped object lookups (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of AI-related metadata, including credit allocations and usage statistics for AI personas and LLM models that are not intended to be publicly accessible. The impact is limited to confidentiality — there is no impact on integrity or availability of the affected system. While the information exposed is sensitive from a business/operational perspective (e.g., revealing AI usage costs or configurations), the vulnerability does not enable lateral movement, code execution, or data modification (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.038%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated session on a vulnerable Discourse instance with the AI plugin enabled, making it relatively low-effort for any registered user (GitHub Advisory).

1. Reconnaissance: Identify a Discourse instance running a vulnerable version (2026.1.0–2026.1.1, 2026.2.0, or 2026.3.0-latest prior to latest.1) with the AI plugin enabled.
2. Authentication: Log in to the Discourse instance with any standard user account (no elevated privileges required).
3. Enumerate object identifiers: Identify or enumerate valid identifiers for AI personas, features, or LLM models — these may be discoverable through normal platform interaction, API responses, or sequential ID guessing.
4. Send crafted requests: Issue direct HTTP requests to the AI plugin's status lookup endpoints, supplying the enumerated object identifiers without proper scoping checks (e.g., GET /ai/status?persona_id=<id> or equivalent endpoint).
5. Retrieve restricted metadata: Parse the API response to obtain credit allocations, usage statistics, and configuration details for AI personas and LLM models that should be restricted to administrators (GitHub Advisory).

• Network: Unusual or repeated API requests from standard user accounts to AI plugin status/metadata endpoints with varying object identifier parameters.
• Logs: Discourse application logs showing authenticated low-privilege users accessing AI persona, feature, or LLM model metadata endpoints at high frequency or with sequential/enumerated IDs.
• Logs: Access log entries for endpoints related to AI status lookups originating from accounts that would not normally interact with AI administrative features.

Discourse has released patched versions: 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, all of which contain a fix for this vulnerability. Administrators who cannot immediately upgrade should disable the AI plugin as a temporary workaround to eliminate the attack surface. Upgrading to a patched version is the recommended long-term remediation (GitHub Advisory).