CVE-2026-33074
Privilege Escalation via Subscription Tier Bypass in Discourse
Publication date: 2026-03-31
Last updated on: 2026-04-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.3 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.2 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized privilege escalation within the Discourse subscription system.
Specifically, a user can gain benefits of a higher-tier subscription without paying for it, potentially leading to loss of revenue or unfair access to premium features.
The impact on the system's integrity is low, and there is no effect on confidentiality or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, it is recommended to disable the discourse-subscriptions plugin before upgrading to the patched versions.
- Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 where the issue is fixed.
- Disable the discourse-subscriptions plugin temporarily if immediate upgrading is not possible.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthorized privilege escalation within subscription tiers but does not impact system confidentiality or availability.
Since there is no effect on confidentiality or availability of data, the vulnerability is unlikely to directly affect compliance with data protection regulations such as GDPR or HIPAA.
However, unauthorized privilege escalation could potentially lead to indirect compliance risks depending on how subscription benefits relate to access controls or sensitive data within an organization's use of the platform.
Can you explain this vulnerability to me?
CVE-2026-33074 is a moderate severity vulnerability found in the discourse-subscriptions plugin of the Discourse software. It affects versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0.
The vulnerability allows a user who purchases a lower-tier subscription to escalate their privileges by granting themselves the benefits of a higher-tier subscription without authorization.
Exploitation requires network access, no privileges or user interaction, but has high attack complexity, meaning it is not trivial to exploit.
The issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.