CVE-2026-33426
Privilege Escalation via Tag Synonym Editing in Discourse
Publication date: 2026-03-21
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-33426 is a vulnerability in the Discourse open-source discussion platform that affects versions prior to 2026.1.2, 2026.2.1, and 2026.3.0-latest.1. It allows users who have tag-editing permissions to edit or create synonyms for tags that are hidden within restricted tag groups, even if those users do not have visibility into those tags.
This behavior violates expected access controls by permitting modification of hidden tags, which should normally be restricted.
The vulnerability has a low severity rating with a CVSS v3.1 base score of 3.5 and requires high privileges and user interaction to exploit.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Discourse to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.
No known workarounds are available, so applying the patch is the primary mitigation.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can impact you by allowing users with tag-editing permissions to modify or create synonyms for tags that they should not be able to see or edit.'}, {'type': 'paragraph', 'content': "Such unauthorized modifications can lead to confusion or misclassification within the platform's tagging system, potentially affecting content organization and integrity."}, {'type': 'paragraph', 'content': 'However, the overall impact on confidentiality and integrity is considered low, and there is no impact on availability.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.