CVE-2026-33424
Unauthorized Access via Private Message Invites in Discourse
Publication date: 2026-03-21
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33424 is a moderate severity vulnerability in the Discourse open-source discussion platform. It allows an attacker to grant access to a private message (PM) topic through invites even after the attacker has lost their own access to that PM.
To exploit this vulnerability, the attacker needs adjacent network access, high privileges, and user interaction. The attack is complex and does not change the security scope, but it results in high confidentiality and integrity impacts.
The issue affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, which contain the patch fixing this vulnerability.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can impact you by allowing unauthorized users to gain access to private message topics even after their own access has been revoked.'}, {'type': 'paragraph', 'content': 'This leads to a high impact on confidentiality and integrity of private communications, potentially exposing sensitive information or allowing unauthorized message manipulation.'}, {'type': 'paragraph', 'content': "The availability impact is low, meaning the system's availability is not significantly affected."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Discourse to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.
No known workarounds are available, so applying the patch by upgrading is the only effective mitigation.