Authorization Flaw in Discourse Open-Source Discussion Platform
CVE-2026-33428

4.9MEDIUM

Key Information:

Vendor

Discourse
Status
Discourse
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33428?

An authorization flaw in Discourse allows non-staff users with elevated group memberships to access deleted posts belonging to any user. This occurs due to an insufficiently restrictive authorization check within the deleted posts index endpoint, potentially exposing sensitive information. The issue is resolved in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, and no known workarounds are available, making it essential for users to update to these versions to mitigate the risk.

Affected Version(s)

discourse = 2026.3.0-latest = 2026.3.0-latest

discourse >= 2026.2.0-latest, < 2026.2.1 < 2026.2.0-latest, 2026.2.1

discourse >= 2026.1.0-latest, < 2026.1.2 < 2026.1.0-latest, 2026.1.2

References

https://github.com/discourse/discourse/security/advisorie...
x_refsource_CONFIRM

CVSS V4

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.