What is the CVSS score of CVE-2026-33291?

CVE-2026-33291 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33291?

Organizations using Discourse should be aware of moderate risk from CVE-2026-33291, a incorrect authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-33291?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-33291

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-20 GitHub_M

Authentication Bypass Discourse

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 22:56 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators can create Zendesk tickets for topics they do not have access to view. This affects all forums that use the Zendesk plugin. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

A broken access control vulnerability in Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allows moderators to create Zendesk support tickets for topics they lack permission to view, bypassing intended access restrictions. This affects all Discourse forums utilizing the Zendesk plugin integration. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has no publicly disclosed active exploitation or proof-of-concept code, though patches are available from the vendor.

Technical ContextAI

Discourse (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) is an open-source discussion platform built on Ruby on Rails. The vulnerability exists in the Zendesk plugin integration layer, which provides functionality to create support tickets from forum topics. The root cause falls under CWE-863 (Incorrect Authorization), indicating that authorization checks are either missing or improperly implemented when moderators attempt to create Zendesk tickets. Specifically, the plugin fails to validate that a moderator has permission to view or access a topic before allowing ticket creation, creating a direct escalation path where moderators can interact with restricted content through the ticket creation mechanism. This is a privilege-based access control bypass affecting the plugin's authorization middleware.

RemediationAI

Upgrade Discourse immediately to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later, depending on your release branch (see https://github.com/discourse/discourse/security/advisories/GHSA-p26h-jqr4-r6j7 for details). No workarounds are available according to the vendor advisory. If immediate patching is not possible, disable the Zendesk plugin integration until the upgrade can be completed, and audit existing Zendesk tickets to identify any created by moderators for restricted topics. Additionally, restrict moderator role assignments to trusted individuals and implement monitoring/logging on Zendesk ticket creation events originating from Discourse.