CVE-2026-32099 - Discourse prevents hidden profile data leak via user onebox

Back Back to CVE browser

MEDIUM

Discourse prevents hidden profile data leak via user onebox

Published Mar 19, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.35%

Description

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has `hide_profile` enabled, their bio, location, and website were still exposed through the user onebox preview. An authenticated user could request a onebox for a hidden user's profile URL and receive their hidden profile fields (bio, location, website) in the response. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

Affected products

Vendor Discourse Product Discourse Default
n/a
- Version
  = 2026.3.0-latest
  Status
  affected
  Constraints
  -
- Version
  >= 2026.1.0-latest, < 2026.1.2
  Status
  affected
  Constraints
  -
- Version
  >= 2026.2.0-latest, < 2026.2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Discourse

n/a

Version	Status	Constraints
= 2026.3.0-latest	affected	-
>= 2026.1.0-latest, < 2026.1.2	affected	-
>= 2026.2.0-latest, < 2026.2.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13332
Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-q83g-cj26-j4x5
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-13332		Advisory
https://github.com/discourse/discourse/security/advisories/GHSA-q83g-cj26-j4x5		x_refsource_CONFIRMVendor Advisory