Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access metadata about AI personas, features, and LLM models by providing their identifiers. This information includes credit allocations and usage statistics which are not intended to be public. The attack is performed over the network, requires low privileges (any logged-in user), and results in a low impact on confidentiality with no impact on integrity or availability. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. To work around this issue, disable AI plugin or upgrade to a patched version.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-32114 Authenticated IDOR Vulnerability in Discourse AI Metadata Exposure https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32114
Post summary
The text briefly identifies CVE-2026-32114 as an authenticated IDOR vulnerability affecting Discourse AI’s metadata, with no mention of PoC, exploitation, patches, or false-positive claims.
CVE-2026-32114 Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDOR) vuln… https://www.cve.org/CVERecord?id=CVE-2026-32114
Post summary
The post references CVE‑2026‑32114, noting an IDOR vulnerability in older Discourse releases without providing PoC, exploit, or patch details, and simply links to the CVE record.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | discourse | discourse | - | - | - |
| App | discourse | discourse | 2026.3.0 | - | - |