Is there a patch available for CVE-2026-33300?

Yes, a patch is available for CVE-2026-33300. Update the affected software to the latest version immediately.

Discourse CVE-2026-33300

Q: What is the CVSS score of CVE-2026-33300?

CVE-2026-33300 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17572 MEDIUM

Information Exposure (CWE-200)

2026-03-31 GitHub_M

Information Disclosure Discourse

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.2.2,2026.1.3,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17572

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse 2026.1.0 through 2026.3.0-beta allows authenticated moderators to bypass authorization controls in the Category Chatables Controller, disclosing sensitive information about hidden group names and user counts. The vulnerability affects multiple release branches and has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0. With a CVSS score of 5.3 and low attack complexity, this represents a meaningful information disclosure risk requiring prompt patching.

Technical ContextAI

Discourse is a modern discussion platform built on Ruby on Rails. The vulnerability exists in the Category Chatables Controller's show action, a component responsible for managing chat-related category settings. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating insufficient access control validation when moderators request category chatables data. The authorization bypass allows moderators-who have elevated privileges but should not access hidden group metadata-to enumerate hidden groups and retrieve user count information without appropriate permission checks. The CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:* indicates all Discourse instances in the affected version ranges are vulnerable.

RemediationAI

Vendor-released patch available in versions 2026.1.3, 2026.2.2, and 2026.3.0. Administrators running affected Discourse instances should upgrade immediately: users on 2026.1.x should upgrade to 2026.1.3 or later, users on 2026.2.x should upgrade to 2026.2.2 or later, and users on 2026.3.0-beta should upgrade to the final 2026.3.0 release. The fix is documented in GitHub commit 07f66658cce81a099a0d7115db5f3c69f5d3cca2 and included in all patched versions listed above. No workarounds are available; patching is the required remediation. Refer to the official GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-wrwm-vqx2-6x4v for upgrade instructions and timeline.