What is the CVSS score of CVE-2026-33251?

CVE-2026-33251 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33251?

Organizations using Discourse should be aware of moderate risk from CVE-2026-33251, a incorrect authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-33251?

Within 30 days: Identify affected systems running hidden Solved topics may allow unauthorized users to accept and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-33251

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-20 GitHub_M

Authentication Bypass Discourse

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:52 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an authorization bypass vulnerability in hidden Solved topics may allow unauthorized users to accept or unaccept solutions. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, ensure only trusted users are part of the Site Setting for accept_all_solutions_allowed_groups.

AnalysisAI

An authorization bypass vulnerability in Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allows authenticated users to accept or unaccept solutions in hidden Solved topics without proper authorization checks. The vulnerability affects the open-source Discourse discussion platform and permits users with valid credentials to manipulate solution status across topics they should not have access to, resulting in information disclosure and integrity violations. This is a low-to-moderate severity issue with a CVSS score of 5.4 that requires prior authentication but carries exploitation risk in multi-tenant or federated Discourse installations.

Technical ContextAI

The vulnerability stems from an authorization control weakness in Discourse's solution acceptance mechanism for hidden topics (CWE-863: Incorrect Authorization). Discourse is built on Ruby on Rails and implements a topic-access control system that verifies user permissions for standard operations. The affected functionality manages the 'Solved' topic plugin, which allows users to mark posts as solutions to discussion questions. The vulnerability manifests when authorization checks fail to properly validate user permissions against topic visibility settings during solution acceptance or unacceptance actions, allowing the vulnerable code path to process requests from authenticated but unauthorized users. The issue is particularly acute because it bypasses visibility-based access controls that should restrict operations on hidden topics. CPE identifier cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* indicates all Discourse product versions below the patched releases are potentially affected.

RemediationAI

Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later immediately, following the patched versions appropriate to your release track as documented at https://github.com/discourse/discourse/security/advisories/GHSA-vm2x-9h8x-7jxm. As an interim workaround, restrict the Site Setting accept_all_solutions_allowed_groups to only include trusted users with explicit authorization to accept solutions across your Discourse instance. Additionally, audit your Discourse audit logs for any unauthorized solution acceptance or unacceptance events, particularly on hidden topics created prior to patching. Consider temporarily disabling the Solved topic plugin if it is not critical to operations and patching cannot be deployed immediately.