CVE-2026-33415
Access Control Bypass in Discourse Sentiment Analytics Endpoint
Publication date: 2026-03-31
Last updated on: 2026-04-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | 2026.3.0 |
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.3 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.2 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33415 is an improper access control vulnerability in the Discourse AI component of the Discourse platform. It allows authenticated users with moderator-level privileges to bypass category permission restrictions on a sentiment analytics API endpoint.
Due to insufficient access controls, these moderators could retrieve post content, topic titles, and usernames from categories they were not authorized to view.
This issue affects Discourse versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, and has been fixed in versions 2026.1.3, 2026.2.2, and 2026.3.0.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated moderator-level users to bypass category permission boundaries and retrieve post content, topic titles, and usernames from categories they are not authorized to view. Such unauthorized access to potentially sensitive user data could lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict access controls and protection of personal data.
By exposing user-generated content and usernames without proper authorization, the issue risks violating principles of data minimization and confidentiality mandated by these standards.
However, the vulnerability has been rated as low severity and has been patched in later versions, so applying these updates is critical to maintaining compliance.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive information within the Discourse platform.
Specifically, moderator-level users could access post content, topic titles, and usernames from categories they should not have permission to view, potentially exposing confidential or restricted discussions.
Such unauthorized access could undermine trust in the platform's privacy controls and lead to information leakage within an organization or community.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an authenticated moderator-level user exploiting insufficient access controls on a sentiment analytics API endpoint to access post content, topic titles, and usernames from unauthorized categories.
Detection would involve monitoring or testing API calls to the sentiment analytics endpoint to verify if category permission boundaries are enforced correctly.
Specifically, you can attempt to access the sentiment posts endpoint as a moderator and check if posts from unauthorized categories are returned.
Since the fix involves filtering posts by allowed category IDs, you could test by sending requests to the sentiment analytics API and verifying if the response includes posts from categories outside the moderator's permissions.
No explicit commands are provided in the resources, but a practical approach would be to use API testing tools like curl or Postman to send authenticated requests to the sentiment posts endpoint and analyze the returned data.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate mitigation is to update Discourse to one of the patched versions: 2026.1.3, 2026.2.2, or 2026.3.0.
These versions include fixes that enforce proper category permission filtering on the sentiment analytics endpoint, preventing unauthorized access.
Until the update can be applied, consider restricting moderator-level user access to the sentiment analytics API or disabling the discourse-ai component if feasible.