Discourse CVE-2026-33251

The CVSS v3.1 score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates this is a moderate-severity issue with networked attack vector, low complexity, and requirement for prior user authentication. The vulnerability allows both confidentiality and integrity compromise (reading solution metadata and modifying solution status) without affecting availability. The attack requires valid user credentials but no user interaction, making it automatable and attractive for account-based abuse or privilege escalation in multi-user Discourse communities. The vulnerability does not appear to have active exploitation signals or public proof-of-concept code based on available references, placing it in the lower-medium priority band. However, the authorization bypass nature combined with solution functionality (which may contain sensitive information or affect content ranking) and the requirement for only basic user privileges elevates practical risk in production Discourse installations managing sensitive discussions.

An authenticated but unprivileged user on a Discourse community discovers a hidden troubleshooting topic where a solution has been marked incorrectly. Rather than requesting the topic creator or moderator to fix it, the attacker crafts HTTP requests to the solution acceptance API endpoint with the topic ID and post ID of their chosen solution, bypassing authorization checks that should restrict modification to topic creators and moderators only. The attacker successfully unmarks the existing solution and marks their own post as the solution, potentially misleading community members who search for solutions or promoting misinformation. The low attack complexity and lack of UI interaction requirements make this easily automatable for account takeover scenarios or coordinated manipulation of community knowledge bases.