CVE-2026-33415
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Discourse, an open-source discussion platform, has a vulnerability in a sentiment analytics endpoint. An authenticated moderator-level user can retrieve post content, topic titles, and usernames from unauthorized categories. The issue is fixed in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Risk Assessment
The risk involves leakage of sensitive data from restricted categories, potentially compromising information confidentiality within the organization.
Recommendation
Immediately upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0, depending on the branch in use.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.