Access Control Flaw in Discourse Discussion Platform by Discourse
CVE-2026-33415

5.1MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
31 March 2026

What is CVE-2026-33415?

The vulnerability affects the Discourse discussion platform, allowing authenticated users with moderator privileges to access content and user information from categories outside their authorization. This incident stems from insufficient access control measures within the sentiment analytics endpoint, which mistakenly allowed users to bypass established permission boundaries. The issue has been addressed in subsequent releases, reinforcing the need for prompt updates to maintain data security.

Affected Version(s)

discourse >= 2026.1.0-latest, < 2026.1.3 < 2026.1.0-latest, 2026.1.3

discourse >= 2026.2.0-latest, < 2026.2.2 < 2026.2.0-latest, 2026.2.2

discourse >= 2026.3.0-latest, < 2026.3.0 < 2026.3.0-latest, 2026.3.0

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM
https://github.com/discourse/discourse/commit/e1bb146a1fa...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.