Access Control Vulnerability in Discourse by Discourse

CVE-2026-33291

What is CVE-2026-33291?

Discourse, a widely used open-source discussion platform, has been identified with an access control vulnerability that allows moderators to create Zendesk tickets for topics that they do not have permission to view. This flaw impacts all forums utilizing the Zendesk plugin and places sensitive information at risk. The issue has been resolved in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 through an official patch. It is important for users to upgrade to these versions as there are no known workarounds available.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References