CVE-2026-32615: 
NixOS vulnerability analysis and mitigation

CVE-2026-32615 is an improper authorization vulnerability in Discourse, an open-source discussion platform, that allows authenticated category group moderators to perform privileged actions on topics inside private categories they do not have read access to. It affects versions 2026.1.0-latest through before 2026.1.3, 2026.2.0-latest through before 2026.2.2, and 2026.3.0-latest through before 2026.3.0. The vulnerability was published on March 31, 2026, and patched versions were released shortly after. It carries a CVSS v3.1 base score of 5.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-285 (Improper Authorization): the can_see_summary? guardian method in Discourse's AI summarization plugin failed to properly enforce read-access restrictions when evaluating whether a category group moderator could act on a topic. Specifically, the method did not correctly pass or evaluate the cached summary state in the context of private category access checks, allowing moderators to bypass category-level read restrictions. The fix (commit 5a00b47) refactored can_see_summary? to accept a cached_summary parameter and enforced that users without summarization privileges cannot be served outdated or restricted content, while also adding proper access checks in the SummaryController and background job pipeline (GitHub Commit, GitHub Advisory).

An authenticated attacker holding category group moderator privileges could exploit this flaw to read and modify topics within private categories they were not authorized to access. This results in unauthorized disclosure of confidential information contained in restricted category topics, as well as unauthorized modification of topic content, comments, or metadata. Availability is not impacted, and the scope is limited to the affected Discourse instance without direct lateral movement potential (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires an authenticated account with category group moderator privileges, limiting the attack surface. The EPSS score is approximately 0.038%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no threat actor attribution has been reported.

1. Obtain moderator role: Authenticate to the Discourse instance as a user who has been assigned category group moderator privileges for at least one category.
2. Identify target private category: Enumerate or infer the existence of private categories the moderator account does not have read access to (e.g., via topic IDs referenced in notifications or API responses).
3. Invoke privileged actions: Use Discourse's topic summarization or moderation API endpoints (e.g., the AI summary controller at /discourse-ai/summarization/summary) with a valid topic_id belonging to a restricted private category, bypassing the read-access check due to the improper authorization flaw.
4. Access or modify content: Retrieve AI-generated summaries of private topics or perform other moderator-level actions (editing, pinning, closing) on topics in categories the account should not be able to read (GitHub Advisory, GitHub Commit).

• Logs: Discourse application logs showing authenticated moderator accounts accessing /discourse-ai/summarization/summary endpoints with topic_id values belonging to private categories outside their assigned scope.
• Logs: Unexpected moderator actions (edits, status changes) recorded in Discourse's staff action logs for topics in private categories the moderator was not explicitly granted access to.
• Network: API requests from moderator accounts to topic endpoints for private categories, particularly repeated or scripted access patterns suggesting enumeration of restricted topic IDs.

Discourse has released patched versions addressing this vulnerability: 2026.1.3, 2026.2.2, and 2026.3.0. Administrators should upgrade to the appropriate patched version for their release branch immediately. As an interim measure, review and audit category group moderator role assignments to ensure no accounts have moderator privileges beyond their intended scope. There is no configuration-based workaround beyond upgrading (GitHub Advisory).