Is there a patch available for CVE-2026-33073?

Yes, a patch is available for CVE-2026-33073. Update the affected software to the latest version immediately.

Discourse CVE-2026-33073

Q: What is the CVSS score of CVE-2026-33073?

CVE-2026-33073 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17567 LOW

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

2.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.2.2,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17567

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:38 nvd

LOW 2.0

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0 leak Stripe API keys across sites in multisite cluster deployments due to improper credential isolation in the discourse-subscriptions plugin, allowing authenticated users with UI access on one site to view payment credentials belonging to other sites within the same cluster. CVSS 2.0 reflects low severity (information disclosure only, requires authentication and user interaction), but the exposure of payment processor credentials carries material business risk. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Technical ContextAI

Discourse is a Ruby-on-Rails-based discussion platform supporting multisite deployments, where multiple independent forum instances share infrastructure but should maintain isolated data contexts. The discourse-subscriptions plugin integrates Stripe payment processing by storing API keys (sensitive authentication material used to query and manage payment data). CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) indicates the root cause: the plugin fails to properly namespace or isolate these keys per site, allowing Stripe credentials configured for Site A to be readable by authenticated users accessing Site B through the same multisite cluster. This is a context-confusion vulnerability specific to multisite architectures where shared backend caching or configuration stores are not properly scoped.

RemediationAI

Upgrade Discourse to patched versions: 2026.1.3 or later for the 2026.1 branch, 2026.2.2 or later for the 2026.2 branch, or 2026.3.0 or later for the 2026.3 branch. For multisite cluster operators, apply the patch across all site instances to ensure credential isolation is restored. No mitigation workaround is documented; patching is the required remediation. Consult the GitHub Security Advisory (https://github.com/discourse/discourse/security/advisories/GHSA-f866-8fcp-fgvv) and the upstream commit (https://github.com/discourse/discourse/commit/c34f2aac8dcd1ae2886fa84256f607bc003f9d80) for technical details and verification steps.