CVE-2026-33427
Received Received - Intake
Open Redirect in Discourse Authorization Page Enables Phishing

Publication date: 2026-03-21

Last updated on: 2026-03-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthenticated attacker can cause a legitimate Discourse authorization page to display an attacker-controlled domain, facilitating social engineering attacks against users. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-21
Last Modified
2026-03-24
Generated
2026-05-07
AI Q&A
2026-03-21
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
discourse discourse From 2026.1.0 (inc) to 2026.1.2 (exc)
discourse discourse From 2026.2.0 (inc) to 2026.2.1 (exc)
discourse discourse 2026.3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

CVE-2026-33427 is a low-severity vulnerability in the Discourse open-source discussion platform affecting certain versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.

An unauthenticated attacker can manipulate the Discourse authorization page to display a domain controlled by the attacker. This means the authorization page can show a misleading domain, which is not validated by the application.

This manipulation facilitates social engineering attacks by tricking users into trusting a malicious domain during the authorization process.

The issue is fixed in the patched versions 2026.1.2, 2026.2.1, and 2026.3.0-latest.1.


How can this vulnerability impact me? :

This vulnerability can impact you by enabling attackers to perform social engineering attacks.

Because the attacker can cause the authorization page to display a domain they control, users may be misled into trusting malicious sites, potentially leading to credential theft or other security breaches.

Although the vulnerability is low severity, it undermines user trust and the integrity of the authorization process.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should update your Discourse installation to one of the patched versions: 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.

No known workarounds are available, so applying the update is the recommended immediate step to prevent exploitation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart