CVE-2026-33428
Received Received - Intake
Authorization Bypass in Discourse Allows Access to Deleted Posts

Publication date: 2026-03-21

Last updated on: 2026-03-24

Assigner: GitHub, Inc.

Description
Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-21
Last Modified
2026-03-24
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33428
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
discourse discourse From 2026.1.0 (inc) to 2026.1.2 (exc)
discourse discourse From 2026.2.0 (inc) to 2026.2.1 (exc)
discourse discourse 2026.3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

This vulnerability can impact you by allowing unauthorized access to deleted posts on the Discourse platform.

A non-staff user with elevated group membership could view deleted content that may contain sensitive or private information, potentially leading to information disclosure.

Since deleted posts are typically expected to be inaccessible to regular users, this unauthorized access undermines data confidentiality and privacy.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, users should upgrade their Discourse installations to the patched versions 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.

No known workarounds are available, so applying the official patch by upgrading is the recommended immediate step.

Executive Summary

CVE-2026-33428 is a vulnerability in the Discourse open-source discussion platform that affects versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.

The issue is caused by an overly broad authorization check on the deleted posts index endpoint. This flaw allows a non-staff user who has elevated group membership to access deleted posts belonging to any user, which they should not be able to see.

The vulnerability occurs because the system does not properly restrict access based on user privileges when querying deleted posts.

The problem has been fixed in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, and users are advised to upgrade to these versions.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33428. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart