CVE-2026-33393
Domain Suffix Bypass in Discourse Spam Host Validation
Publication date: 2026-03-19
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
Can you explain this vulnerability to me?
This vulnerability affects the Discourse open-source discussion platform. Before certain fixed versions, the platform's spam protection check called `allowed_spam_host_domains` used a method that checked if a domain ended with an allowlisted domain without properly validating domain boundaries. This meant that malicious domains like `attacker-example.com` could bypass spam protection if `example.com` was on the allowlist, because the check only looked for a suffix match rather than an exact or proper subdomain match.
The issue was fixed in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 by requiring an exact match or a proper subdomain match (preceded by a dot) to prevent attackers from bypassing the spam host threshold protections.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass spam protection mechanisms on Discourse platforms that have not been updated to the fixed versions. By exploiting the improper domain boundary validation, attackers can use malicious domains that appear similar to allowlisted domains to evade spam filters.
As a result, your platform could receive increased spam or malicious content from domains that should have been blocked, potentially degrading user experience and increasing moderation workload.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Discourse installation to one of the fixed versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.
These versions include a fix that requires exact match or proper subdomain match (preceded by a dot) for the allowed_spam_host_domains check, preventing suffix-based bypass of the newuser_spam_host_threshold.
No known workarounds are available, so upgrading is the immediate and recommended step.