CVE-2026-33074 discourse CVE debrief

Who should care

Users of Discourse, particularly those managing subscriptions and user accounts, should be aware of this vulnerability and take steps to mitigate it. This includes updating to patched versions and reviewing subscription tier assignments.

Technical summary

The vulnerability exists in Discourse versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. An attacker may exploit this issue to purchase a lower tier subscription but gain benefits of a higher tier subscription. This could lead to unauthorized access to higher tier subscription benefits. The issue has significant implications for user account management and subscription services, particularly in managing and monitoring subscription tiers and benefits. Users should review and update their systems to patched versions and implement compensating controls to detect and prevent unauthorized access.

Defensive priority

Medium priority due to the potential for unauthorized access to higher tier subscription benefits.

Recommended defensive actions

• Update Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 or later.
• Review and monitor subscription tier assignments and benefits.
• Implement compensating controls to detect and prevent unauthorized access to higher tier subscription benefits.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-03-31T18:16:51.963Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. This vulnerability affects Discourse versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. The issue allows a user to purchase a lower tier subscription but grant themselves the benefits of a higher tier subscription. Evidence is limited to CVE and NVD details.

Official resources