Executive Summary

CVE-2026-33425 is a vulnerability in the Discourse open-source discussion platform that allows unauthenticated users to determine whether a specific user is a member of a private group. This is done by exploiting the behavior of the `exclude_groups` parameter in directory queries. By observing changes in directory results when using this parameter, an attacker can infer private group membership or the existence of private groups.

The vulnerability arises from authorization weaknesses, including observable discrepancies in system behavior, authorization bypass through user-controlled keys, and missing authorization checks.

It affects versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, which contain patches for this issue.

Useful 0 Not Useful 0

Impact Analysis

[{'type': 'paragraph', 'content': 'This vulnerability can impact you by allowing unauthorized, unauthenticated users to gain limited information about private group memberships within your Discourse platform. Although it does not allow modification or deletion of data, it leaks confidential information about user group memberships.'}, {'type': 'paragraph', 'content': 'This information disclosure could be used for targeted social engineering or reconnaissance by attackers.'}, {'type': 'paragraph', 'content': 'A recommended mitigation is to disable public access to the user directory by enabling the "hide user profiles from public" setting in the admin panel.'}] [1]

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by observing the behavior of the Discourse user directory when using the `exclude_groups` parameter in directory queries. Specifically, an unauthenticated user can send requests to the directory endpoint with and without the `exclude_groups` parameter and compare the results. Differences in the directory results indicate whether a specific user is a member of a private group.'}, {'type': 'paragraph', 'content': 'To detect this on your system, you can perform HTTP requests to the Discourse user directory API endpoint, for example using curl commands, and compare the responses.'}, {'type': 'list_item', 'content': "curl -s 'https://your-discourse-site.com/directory_items.json?exclude_groups=private_group_name' -o response_with_exclude.json"}, {'type': 'list_item', 'content': "curl -s 'https://your-discourse-site.com/directory_items.json' -o response_without_exclude.json"}, {'type': 'paragraph', 'content': 'By comparing the two responses (response_with_exclude.json and response_without_exclude.json), you can determine if the directory results differ based on the `exclude_groups` parameter, which indicates the presence of the vulnerability.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'The immediate mitigation step is to disable public access to the user directory in Discourse. This can be done by enabling the setting "hide user profiles from public" in the Admin panel under Settings.'}, {'type': 'paragraph', 'content': 'Additionally, upgrading Discourse to one of the patched versions 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 will fully resolve the vulnerability.'}] [1]

Useful 0 Not Useful 0