Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerability in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure only trusted users are part of the Site Setting for accept_all_solutions_allowed_groups.
References
| Link | Resource |
|---|---|
| https://github.com/discourse/discourse/security/advisories/GHSA-vm2x-9h8x-7jxm | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Mar 2026, 20:55
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-vm2x-9h8x-7jxm - Mitigation, Vendor Advisory | |
| First Time |
Discourse
Discourse discourse |
20 Mar 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-20 23:16
Updated : 2026-03-24 20:55
NVD link : CVE-2026-33251
Mitre link : CVE-2026-33251
CVE.ORG link : CVE-2026-33251
JSON object : View
Products Affected
discourse
- discourse
CWE
CWE-863
Incorrect Authorization