Is there a patch available for CVE-2026-33185?

Yes, a patch is available for CVE-2026-33185. Update the affected software to the latest version immediately.

Discourse CVE-2026-33185

Q: What is the CVSS score of CVE-2026-33185?

CVE-2026-33185 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17571 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-31 GitHub_M

SSRF Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.2.2,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17571

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:41 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the group email settings test endpoint could be used to make the server initiate outbound connections to arbitrary hosts and ports. This could allow probing of internal network infrastructure. The endpoint was accessible to non-staff group owners. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Server-side request forgery (SSRF) in Discourse group email settings test endpoint allows authenticated non-staff group owners to initiate outbound connections to arbitrary hosts and ports, enabling internal network reconnaissance. Affects Discourse 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-rc versions. Patched in 2026.1.3, 2026.2.2, and 2026.3.0. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability is a Server-Side Request Forgery (CWE-918) in Discourse's group email settings test endpoint. This endpoint was designed to validate email configuration but lacked proper network boundary enforcement, allowing it to be abused as a proxy for initiating connections to internal infrastructure. The flaw exists because the endpoint failed to restrict destinations to legitimate mail servers or block private IP address ranges (RFC 1918), instead accepting arbitrary host and port parameters from authenticated but non-privileged group owners. The SSRF attack surface is particularly dangerous in containerized or cloud deployments where internal services (databases, caches, metadata servers, admin panels) are accessible via localhost or internal VLANs.

RemediationAI

Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 (or later) depending on your current release track. These versions include a fix (commit e75cf456e8e318290c569bd6e8fa0f2586ffc530) that restricts the group email settings test endpoint to authorized staff members and adds network boundary validation. For organizations unable to upgrade immediately, restrict access to group owner roles through administrative policy or disable the email settings test feature entirely until a patched version can be deployed. Refer to the GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-5976-77mj-m4h3 for detailed mitigation guidance and the upstream commit details.