Executive Summary

CVE-2026-33073 is a vulnerability in the discourse-subscriptions plugin used in Discourse multisite environments. It causes leakage of Stripe API keys across different sites within the same multisite cluster, potentially exposing sensitive Stripe-related information to unauthorized sites.

The issue arises because the plugin improperly isolates Stripe API keys in a multisite setup, allowing cross-site leakage. Exploitation requires network access, low privileges, and active user interaction, with high complexity due to security mechanisms in place.

The vulnerability affects versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0. It has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to leakage of Stripe API keys across sites within the same multisite cluster, potentially exposing sensitive payment-related information to unauthorized parties.

The impact is primarily on confidentiality and integrity at a low level, meaning limited unauthorized information disclosure and modification could occur.

There is no impact on system availability.

An attacker with low privileges and network access, requiring active user interaction, could exploit this vulnerability, but the attack complexity is high due to existing security conditions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves leakage of Stripe API keys across sites in a Discourse multisite cluster due to improper isolation in the discourse-subscriptions plugin. Detection involves verifying if your Discourse installation is running an affected version of the discourse-subscriptions plugin (versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, or 2026.3.0-latest to before 2026.3.0).

You can check the installed plugin version by running commands within your Discourse environment or container, for example:

• Check the discourse-subscriptions plugin version in your Discourse installation by inspecting the plugin directory or using git commands if installed via git: `cd /var/www/discourse/plugins/discourse-subscriptions && git describe --tags`
• Search your Discourse logs or network traffic for unexpected Stripe API key exposure or cross-site API calls.
• Monitor network traffic for Stripe API keys being sent or received across different sites in the multisite cluster.

Since the vulnerability requires network access and low privileges, also review access logs for suspicious activity involving subscription finalization endpoints or Stripe API usage.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation is to upgrade the discourse-subscriptions plugin to a patched version: 2026.1.3, 2026.2.2, or 2026.3.0 or later, depending on your Discourse version.

If upgrading immediately is not possible, the recommended workaround is to remove the discourse-subscriptions plugin entirely to prevent Stripe API key leakage across sites.

Additionally, review and restrict access to the subscription finalize endpoint to prevent unauthorized group access.

Ensure that your environment does not use global Stripe API key settings and that Stripe API keys are handled per request as per the patched plugin implementation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the discourse-subscriptions plugin causes leakage of Stripe API keys across sites within the same multisite cluster, potentially exposing sensitive payment-related information to unauthorized parties.

Such leakage of sensitive financial API keys could lead to unauthorized access to payment processing data, which may impact compliance with standards and regulations that require protection of sensitive data, such as GDPR and HIPAA.

However, the vulnerability is rated with a low severity (CVSS v4 base score 2.0) and the impact is limited to low confidentiality and integrity issues without availability impact.

Organizations using affected versions should upgrade to patched versions or remove the plugin to mitigate risks and maintain compliance with data protection requirements.

Useful 0 Not Useful 0