What is the CVSS score of CVE-2026-33355?

CVE-2026-33355 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33355?

Organizations using Discourse should be aware of notable risk from CVE-2026-33355, a information exposure vulnerability rated CVSS 6.5. Sensitive information could be exposed to unauthorized parties.

How to fix or mitigate CVE-2026-33355?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Discourse CVE-2026-33355

MEDIUM

Information Exposure (CWE-200)

2026-03-19 security-advisories@github.com

Information Disclosure Discourse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 19, 2026 - 22:30 vuln.today

CVE Published

Mar 19, 2026 - 22:16 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the /private-posts endpoint did not apply post-type visibility filtering, allowing regular PM participants to see whisper posts in PM topics they had access to. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

A post-type visibility filtering bypass in Discourse's /private-posts endpoint allows authenticated users with access to private message (PM) topics to view whisper posts that should be restricted to specific recipients. This information disclosure vulnerability affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, and requires only low-privilege user authentication to exploit. No active exploitation in the wild has been reported, but patches are available from the vendor.

Technical ContextAI

Discourse is an open-source discussion platform built on Ruby on Rails that manages complex permission models for different post types, including standard posts, whispers (which are private comments visible only to specific users), and private messages. The vulnerability resides in the /private-posts endpoint, which is responsible for retrieving private messages accessible to the authenticated user. The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating that the endpoint fails to properly apply post-type visibility filtering logic when returning PM data. Whisper posts are intended to be visible only to their author and explicitly designated recipients, but the missing filter allows any PM topic participant to enumerate and read these restricted posts. This represents a failure in authorization logic at the application layer where post-type constraints are not enforced alongside topic-level access controls.

RemediationAI

Immediately upgrade Discourse to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 depending on your release track. Apply the patches referenced in commits 84e5865a279716c6866e8c0648d1d8b42320603c, d25b8ee9ee182dbb34e92b34e39878ce4d59bcdc, and d2f317271ad7638f1e2791905472ebd9370946d1 available at https://github.com/discourse/discourse. No workarounds exist, so patching is mandatory. If immediate patching is not possible, restrict PM access to trusted users only and audit PM topics for sensitive whisper content that may have been exposed. Monitor Discourse logs for unusual /private-posts endpoint access patterns from low-privilege accounts.