Data Exposure Vulnerability in Discourse Plugin by Discourse

CVE-2026-33073

What is CVE-2026-33073?

The Discourse discussion platform has a vulnerability in the discourse-subscriptions plugin that allows for the leakage of Stripe API keys across sites within a multisite cluster. This issue affects versions ranging from 2026.1.0-latest to prior to 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. Consequently, sensitive Stripe-related information could be inadvertently shared among multiple sites. The flaw has since been addressed in subsequent releases, ensuring enhanced security for users.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References