PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33415 discourse CVE debrief

CVE-2026-33415 is a vulnerability in Discourse, an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0. The vulnerability allows category permission boundaries to be bypassed due to insufficient access controls on a sentiment analytics endpoint.

Vendor
discourse
Product
Unknown
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Users of Discourse, particularly those with moderator-level access, should be aware of this vulnerability and ensure their instances are updated to the patched versions. Additionally, administrators and security teams responsible for managing Discourse installations should review and adjust category permissions to prevent unauthorized access.

Technical summary

The vulnerability is caused by insufficient access controls on a sentiment analytics endpoint in Discourse. This allows category permission boundaries to be bypassed, enabling authenticated moderator-level users to retrieve post content, topic titles, and usernames from categories they are not authorized to view. The issue arises from a lack of proper authorization checks on the endpoint, which can be exploited by users with moderator-level access.

Defensive priority

Medium

Recommended defensive actions

  • Update Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0, or later
  • Review and adjust category permissions to ensure proper access controls
  • Monitor for suspicious activity, especially from moderator-level users
  • Verify the integrity of post content, topic titles, and usernames
  • Conduct regular security audits to detect potential exploitation
  • Implement additional monitoring and logging to track access to sensitive categories

Evidence notes

The CVE record was published on 2026-03-31T18:16:52.410Z and was last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus and may not reflect the full scope of the vulnerability. Further verification is recommended to ensure accurate understanding of the issue.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33415 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33415

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33415 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33415

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.