CVE-2026-33428
Authorization Bypass in Discourse Allows Access to Deleted Posts
Publication date: 2026-03-21
Last updated on: 2026-03-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| discourse | discourse | From 2026.1.0 (inc) to 2026.1.2 (exc) |
| discourse | discourse | From 2026.2.0 (inc) to 2026.2.1 (exc) |
| discourse | discourse | 2026.3.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized access to deleted posts on the Discourse platform.
A non-staff user with elevated group membership could view deleted content that may contain sensitive or private information, potentially leading to information disclosure.
Since deleted posts are typically expected to be inaccessible to regular users, this unauthorized access undermines data confidentiality and privacy.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should upgrade their Discourse installations to the patched versions 2026.1.2, 2026.2.1, or 2026.3.0-latest.1.
No known workarounds are available, so applying the official patch by upgrading is the recommended immediate step.
Can you explain this vulnerability to me?
CVE-2026-33428 is a vulnerability in the Discourse open-source discussion platform that affects versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2.
The issue is caused by an overly broad authorization check on the deleted posts index endpoint. This flaw allows a non-staff user who has elevated group membership to access deleted posts belonging to any user, which they should not be able to see.
The vulnerability occurs because the system does not properly restrict access based on user privileges when querying deleted posts.
The problem has been fixed in versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, and users are advised to upgrade to these versions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know