Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
References
Configurations
Configuration 1 (hide)
|
History
10 Apr 2026, 01:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 2.7 |
| CPE | cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest.1:*:*:* cpe:2.3:a:discourse:discourse:*:*:*:*:latest:*:*:* cpe:2.3:a:discourse:discourse:2026.3.0:*:*:*:latest:*:*:* |
|
| First Time |
Discourse
Discourse discourse |
|
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/discourse/discourse/commit/e1bb146a1fadc863a516fbc26c6277273a025308 - Patch | |
| References | () https://github.com/discourse/discourse/security/advisories/GHSA-vj5f-gg8m-93xg - Vendor Advisory |
03 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.3 |
31 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 18:16
Updated : 2026-04-10 01:50
NVD link : CVE-2026-33415
Mitre link : CVE-2026-33415
CVE.ORG link : CVE-2026-33415
JSON object : View
Products Affected
discourse
- discourse
CWE