BIT-discourse-2026-32244: Discourse: Cached outdated summaries can leak removed content
Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0 have a vulnerability where outdated cached AI-generated summaries can expose removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been addressed in the specified fixed versions. A temporary mitigation involves restricting summary generation by tightening allowed groups on summarization Personas.
AI Analysis
Technical Summary
Discourse, an open-source discussion platform, contained a vulnerability identified as CVE-2026-32244 affecting versions before 2026.1.4, between 2026.3.0 and before 2026.3.1, and between 2026.4.0 and before 2026.4.1. The vulnerability allows outdated cached AI summaries to leak content that was removed from discussions to users without appropriate privileges, including anonymous users who cannot regenerate the summaries. The issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0. As a workaround, administrators can restrict summary generation by limiting the allowed groups on the summarization Personas feature.
Potential Impact
The vulnerability can lead to unauthorized disclosure of removed content through cached AI summaries, potentially exposing sensitive or deleted information to users who should not have access, including anonymous and unprivileged users. There is no indication of active exploitation in the wild.
Mitigation Recommendations
A fix is available in Discourse versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0. Users should upgrade to one of these versions to remediate the issue. As a temporary workaround before upgrading, restrict summary generation by tightening the allowed groups on the summarization Personas to limit who can generate summaries.
BIT-discourse-2026-32244: Discourse: Cached outdated summaries can leak removed content
Description
Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0 have a vulnerability where outdated cached AI-generated summaries can expose removed content to anonymous and unprivileged users who cannot regenerate summaries. This issue has been addressed in the specified fixed versions. A temporary mitigation involves restricting summary generation by tightening allowed groups on summarization Personas.
Affected software
pkg:bitnami/discourseRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Discourse, an open-source discussion platform, contained a vulnerability identified as CVE-2026-32244 affecting versions before 2026.1.4, between 2026.3.0 and before 2026.3.1, and between 2026.4.0 and before 2026.4.1. The vulnerability allows outdated cached AI summaries to leak content that was removed from discussions to users without appropriate privileges, including anonymous users who cannot regenerate the summaries. The issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0. As a workaround, administrators can restrict summary generation by limiting the allowed groups on the summarization Personas feature.
Potential Impact
The vulnerability can lead to unauthorized disclosure of removed content through cached AI summaries, potentially exposing sensitive or deleted information to users who should not have access, including anonymous and unprivileged users. There is no indication of active exploitation in the wild.
Mitigation Recommendations
A fix is available in Discourse versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0. Users should upgrade to one of these versions to remediate the issue. As a temporary workaround before upgrading, restrict summary generation by tightening the allowed groups on the summarization Personas to limit who can generate summaries.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-discourse-2026-32244
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-32244"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a577ed268715ace43b3f79a
Added to database: 07/15/2026, 12:36:34 UTC
Last enriched: 07/15/2026, 12:43:03 UTC
Last updated: 07/25/2026, 09:43:04 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.