Is there a patch available for CVE-2026-33074?

Yes, a patch is available for CVE-2026-33074. Update the affected software to the latest version immediately.

Discourse CVE-2026-33074

Q: What is the CVSS score of CVE-2026-33074?

CVE-2026-33074 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17569 MEDIUM

Improper Privilege Management (CWE-269)

2026-03-31 GitHub_M

Privilege Escalation Discourse

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.1.3,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17569

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:41 nvd

MEDIUM 6.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-pre allow authenticated users to escalate their subscription tier by purchasing a lower-cost plan while obtaining benefits reserved for higher-tier subscriptions. The vulnerability has a CVSS 6.3 score reflecting the integrity impact, requires high attack complexity and partial timing conditions, but affects confidentiality minimally. Vendor-released patches address the flaw in versions 2026.1.3, 2026.2.2, and 2026.3.0, and the exploit likely requires knowledge of the subscription grant mechanism.

Technical ContextAI

The vulnerability is rooted in improper access control (CWE-269: Improper Access Control) within Discourse's subscription tier management system. Discourse is a Ruby on Rails-based discussion and community platform that manages user roles, permissions, and subscription benefits. The flaw allows privilege escalation through subscription tier manipulation-a user can purchase a lower-cost subscription plan but trigger a code path that assigns benefits typically reserved for higher-tier subscriptions. This suggests inadequate authorization checks between the purchase transaction and the benefit-grant operation, or a race condition in the subscription provisioning logic. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* indicates all prior versions of Discourse are in scope until the patched releases.

RemediationAI

Vendor-released patches: Upgrade Discourse to version 2026.1.3 or later for the 2026.1 branch, version 2026.2.2 or later for the 2026.2 branch, or version 2026.3.0 or later for the 2026.3 branch. The fix is committed in https://github.com/discourse/discourse/commit/c34f2aac8dcd1ae2886fa84256f607bc003f9d80. For organizations unable to upgrade immediately, review subscription grant logic in the codebase and implement additional authorization checks to verify that a user's purchased tier matches the benefits being provisioned. Audit active subscriptions to identify any instances where lower-cost plans were granted higher-tier benefits, and remediate affected accounts by adjusting their subscription tier or benefits accordingly. Consult the GitHub Security Advisory for additional mitigation context.