Is there a patch available for CVE-2026-33415?

Yes, a patch is available for CVE-2026-33415. Update the affected software to the latest version immediately.

Discourse CVE-2026-33415

Q: What is the CVSS score of CVE-2026-33415?

CVE-2026-33415 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17574 MEDIUM

Improper Access Control (CWE-284)

2026-03-31 GitHub_M

Authentication Bypass Discourse

5.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1.3,2026.2.2,2026.3.0

EUVD ID Assigned

Mar 31, 2026 - 18:16 euvd

EUVD-2026-17574

Analysis Generated

Mar 31, 2026 - 18:16 vuln.today

CVE Published

Mar 31, 2026 - 17:42 nvd

MEDIUM 5.1

DescriptionCVE.org

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authenticated moderator-level user could retrieve post content, topic titles, and usernames from categories they were not authorized to view. Insufficient access controls on a sentiment analytics endpoint allowed category permission boundaries to be bypassed. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

AnalysisAI

Discourse versions 2026.1.0-2026.1.2, 2026.2.0-2026.2.1, and 2026.3.0-beta allow authenticated moderators to bypass category permission controls and retrieve post content, topic titles, and usernames from categories they lack authorization to access via a sentiment analytics endpoint. Patches are available (2026.1.3, 2026.2.2, 2026.3.0); no public exploit code or active exploitation has been identified.

Technical ContextAI

Discourse implements role-based access controls (RBAC) to restrict moderator visibility to designated categories. The vulnerability resides in insufficient authorization checks on a sentiment analytics API endpoint, which fails to enforce the same category permission boundaries enforced elsewhere in the application. This is a classic CWE-284 (Improper Access Control) issue where an endpoint performs sensitive operations without verifying the caller's permissions. The affected product is the Discourse discussion platform across multiple release branches (2026.1.x, 2026.2.x, 2026.3.x series). Moderators, who normally have elevated but constrained permissions, can exploit this to read restricted content they should not access.

RemediationAI

Upgrade immediately to patched versions: Discourse 2026.1.3 or later for the 2026.1.x branch, 2026.2.2 or later for the 2026.2.x branch, or 2026.3.0 final release for the 2026.3.x branch. Refer to the official GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-vj5f-gg8m-93xg and the fix commit at https://github.com/discourse/discourse/commit/e1bb146a1fadc863a516fbc26c6277273a025308 for detailed patching guidance. Until patched, consider restricting moderator access to trusted users and auditing moderator account activity for unauthorized API calls to sentiment analytics endpoints.