CVE-2026-33291
Unauthorized Access via Zendesk Ticket Creation in Discourse
Publication date: 2026-03-20
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the Discourse open-source discussion platform when using the Zendesk plugin. Prior to certain fixed versions, moderators were able to create Zendesk tickets for topics they did not have permission to view. This means that moderators could potentially access or expose information from restricted topics by creating tickets related to them.
How can this vulnerability impact me? :
The vulnerability could lead to unauthorized access to sensitive or restricted discussion topics by moderators who should not have permission to view them. This could result in information leakage or exposure of confidential data through Zendesk tickets created for those topics.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update your Discourse installation to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.
No known workarounds are available, so applying the patch by upgrading is the recommended immediate step.