Information Disclosure Flaw in Discourse Open-Source Discussion Platform

CVE-2026-33425

What is CVE-2026-33425?

Discourse, a popular open-source discussion platform, has a vulnerability where unauthenticated users can determine if a specific user belongs to a private group. This can be exploited through the exclude_groups parameter, which makes it possible to see changes in directory results. To mitigate this issue, it is recommended to upgrade to versions 2026.3.0-latest.1, 2026.2.1, or 2026.1.2, which include necessary patches. Additionally, as a temporary workaround, administrators can disable public access to the user directory by modifying settings to hide user profiles from public view.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References