PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33073 discourse CVE debrief

The Discourse discourse-subscriptions plugin has a vulnerability that leaks Stripe API keys across sites in a multisite cluster. This issue was patched in versions 2026.1.3, 2026.2.2, and 2026.3.0. The vulnerability affects versions from 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest. Users of the Discourse platform who utilize the discourse-subscriptions plugin and have a multisite cluster setup should be aware of this vulnerability and take steps to update to a patched version.

Vendor
discourse
Product
Unknown
CVSS
LOW 2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of the Discourse platform who utilize the discourse-subscriptions plugin and have a multisite cluster setup should be aware of this vulnerability and take steps to update to a patched version. This includes administrators and security teams responsible for maintaining and securing Discourse instances.

Technical summary

The discourse-subscriptions plugin for Discourse, an open-source discussion platform, contains a vulnerability that results in the leakage of Stripe API keys across sites within the same multisite cluster. This issue affects versions from 2026.1.0-latest up to but not including 2026.1.3, 2026.2.0-latest up to but not including 2026.2.2, and 2026.3.0-latest. The vulnerability has been addressed in versions 2026.1.3, 2026.2.2, and 2026.3.0. Users should review their current version and update accordingly.

Defensive priority

Low

Recommended defensive actions

  • Update to a patched version of the discourse-subscriptions plugin (2026.1.3, 2026.2.2, or 2026.3.0).
  • Review and restrict access to Stripe API keys.
  • Monitor for potential unauthorized access to Stripe related information.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-03-31T18:16:51.807Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33073 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33073

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33073 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33073

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.