PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33073 discourse CVE debrief

The Discourse discourse-subscriptions plugin has a vulnerability that leaks Stripe API keys across sites in a multisite cluster. This issue was patched in versions 2026.1.3, 2026.2.2, and 2026.3.0. The vulnerability affects versions from 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest. Users of the Discourse platform who utilize the discourse-subscriptions plugin and have a multisite cluster setup should be aware of this vulnerability and take steps to update to a patched version.

Vendor
discourse
Product
Unknown
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of the Discourse platform who utilize the discourse-subscriptions plugin and have a multisite cluster setup should be aware of this vulnerability and take steps to update to a patched version. This includes administrators and security teams responsible for maintaining and securing Discourse instances.

Technical summary

The discourse-subscriptions plugin for Discourse, an open-source discussion platform, contains a vulnerability that results in the leakage of Stripe API keys across sites within the same multisite cluster. This issue affects versions from 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest. The vulnerability has been addressed in versions 2026.1.3, 2026.2.2, and 2026.3.0. Users should review their current version and update accordingly.

Defensive priority

Low

Recommended defensive actions

  • Update to a patched version of the discourse-subscriptions plugin (2026.1.3, 2026.2.2, or 2026.3.0).
  • Review and restrict access to Stripe API keys.
  • Monitor for potential unauthorized access to Stripe related information.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-03-31T18:16:51.807Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-03-31T18:16:51.807Z and has not been modified since then. The NVD entry is currently Analyzed.