Discourse CVE-2026-33300

The CVSS vector (AV:N/AC:L/AT:N/PR:L) confirms network-accessible attack vector with low complexity, requiring only low-level privileges (moderator role). CVSS confidentiality impact is low (VC:L), with no integrity or availability impact. The EPSS score is not provided, but the relatively modest CVSS score of 5.3 reflects the limited scope of impact-information disclosure of group metadata rather than user authentication data or system compromise. However, real-world risk should not be dismissed: moderators are a common attacker vector in collaborative platforms, and disclosure of hidden group existence and membership counts can enable social engineering, competitive intelligence gathering, or organizational reconnaissance. The lack of integrity or availability impact and requirement for authenticated access (PR:L) lowers priority compared to unauthenticated remote code execution, but this is still a security boundary violation requiring remediation. No KEV or public POC status is indicated in the input data.

A Discourse moderator with legitimate access to moderation tools discovers they can query the Category Chatables Controller endpoint to retrieve details about hidden group names and membership counts-information restricted to administrators. The moderator could use this to identify private teams, departments, or groups within their organization, then exploit that knowledge for social engineering, competitive advantage, or targeted harassment of group members. The attack requires only low-complexity network access and the attacker's existing moderator credentials, making it a low-friction information disclosure that could be exploited opportunistically during routine moderation activities.