Discourse CVE-2026-33291

While no CVSS score or EPSS metric has been publicly assigned, the vulnerability presents moderate-to-high real-world risk for organizations using Discourse with the Zendesk plugin. The attack vector is classified as CWE-863 (Incorrect Authorization) and requires moderator-level privileges to exploit, limiting the immediate attack surface to trusted users—however, moderator compromise or malicious insiders become a significant threat vector. The vulnerability is not listed in the CISA KEV catalog (no indication of active exploitation), and no proof-of-concept code is publicly available, which reduces immediate threat intensity. However, the fact that patched versions are available across three release branches (2026.3.0-latest.1, 2026.2.1, 2026.1.2) indicates the vendor treats this as a security-sensitive issue requiring coordinated disclosure. Organizations running vulnerable versions face information disclosure and potential audit/compliance violations if moderators create tickets for restricted topics, exposing sensitive discussions to external ticketing systems. Priority should be elevated for forums handling sensitive or confidential discussions.

A malicious moderator or a compromised moderator account on a Discourse forum could systematically create Zendesk tickets for private or restricted topics they should not be able to view, exfiltrating sensitive discussion content to an external ticketing system where it persists in audit logs and is potentially visible to support staff. Since the attack requires only standard moderator privileges and involves a normal-appearing feature (ticket creation), it would be difficult to detect without explicit access control logging. This is particularly damaging in forums handling confidential business discussions, security vulnerability reports, or private community grievances.