Discourse CVE-2026-33185

CVSS v4.0 score of 5.3 reflects moderate risk with low impact severity-confidentiality loss is limited (VC:L) and integrity/availability are unaffected. The attack requires authentication (PR:L) and low complexity (AC:L), with network-based access (AV:N). SSRF vulnerabilities are inherently concerning because they enable reconnaissance that often precedes higher-impact attacks; however, the limited scope (single endpoint for email settings) and requirement for group owner privileges reduce immediate threat. EPSS data unavailable, but the public advisory, confirmed patch availability across three release tracks, and lack of weaponized POC suggest this is a real but contained vulnerability prioritized for standard patching cycles rather than emergency response. Organizations using Discourse should treat this as a normal-cadence security update, not a critical outbreak.

An authenticated non-staff group owner logs into a Discourse instance and accesses the group email settings configuration page. They manually craft a request to the email test endpoint specifying internal IP addresses and ports (e.g., 127.0.0.1:5432 for a PostgreSQL database or 192.168.1.100:22 for SSH) instead of legitimate mail server addresses. The server, lacking validation, initiates the connection and returns connection status or error messages that reveal whether services exist and are reachable. An attacker could iterate through private address ranges to map the internal network topology, identify running services, and plan follow-up attacks against discovered infrastructure. No public POC exists; exploitation requires authentication and direct knowledge of the endpoint behavior.