Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Discourse cached AI summaries may expose deleted posts

CVE-2026-32244 · published 5 months ago
Summary

Older versions of the Discourse forum software can show outdated AI‑generated summaries that include content that has been deleted. This allows anyone, even users without special rights, to see information that should no longer be visible. Update Discourse to the latest release or limit who can request summaries as a temporary fix.

What to do
  • Update discourse to version 2026.4.1.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – discourse >= 2026.4.0, < 2026.4.1
Fix: upgrade to 2026.4.1
– discourse discourse >= 2026.1.0, < 2026.1.4
>= 2026.3.0, < 2026.3.1
>= 2026.4.0, < 2026.4.1
2026.5.0
cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*
Original advisory text
Discourse: Cached outdated summaries can leak removed content
Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, outdated cached AI summaries can leak removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1. To work around this issue, restrict summary generation by tightening the allowed groups on the summarization Personas.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-524Use of Cache Containing Sensitive Information
CWE-672Operation on a Resource after Expiration or Release
Timeline
Published19 May 2026
Updated4 Nov 2026
First seen19 May 2026
Sources
CVE-2026-32244 · NVD
BIT-discourse-2026-32244 · OSV
GHSA-hjmg-2mww-vfvx · GHSA
CVE-2026-32244 · OSV
Track software like this
Free during beta