CVE-2026-33394
Information Disclosure in Discourse Post Edits Admin Report
Publication date: 2026-03-19
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
Can you explain this vulnerability to me?
This vulnerability exists in the Discourse open-source discussion platform prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. The issue is that the Post Edits admin report (/admin/reports/post_edits) leaked the first 40 characters of raw post content from private messages and secure categories to moderators who should not have had access to this information.
The vulnerability was patched in the specified versions, and no known workarounds are available.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information because moderators without proper permissions could see partial content (first 40 characters) of private messages and posts in secure categories.
Although the impact is limited to a small portion of the message content, it still represents a confidentiality breach which could expose sensitive or private information.
The CVSS base score of 2.7 indicates a low severity impact, with confidentiality impact but no impact on integrity or availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Discourse installation to one of the patched versions: 2026.3.0-latest.1, 2026.2.1, or 2026.1.2.
No known workarounds are available, so applying the patch by upgrading is the immediate recommended action.