Discourse CVE-2026-33415

CVSS 5.1 with vector AV:N/AC:L/PR:H/UI:N indicates a low-severity issue from the base score perspective: remote network access with low complexity, but requiring high-privilege (moderator) authentication-reducing the threat actor pool significantly. EPSS data is not provided, but the authentication requirement (PR:H) is a limiting factor for real-world impact. Exploitation requires an attacker to already possess moderator credentials, which is a substantial prerequisite. No CISA KEV confirmation or public exploit code is reported, indicating this is not yet actively exploited in the wild. However, the vulnerability is meaningful within threat models where internal moderator accounts are compromised or where insider threats are relevant. The low confidentiality impact (VC:L) reflects unauthorized information disclosure rather than system compromise. For organizations with sensitive category structures or strict internal content separation, this should be treated as a moderate priority given the ease of exploitation (AC:L) once authenticated; for others, it may be deferred pending scheduled patching cycles.

A malicious insider with moderator privileges on a Discourse instance could repeatedly call the unprotected sentiment analytics endpoint, iterating through category identifiers to harvest restricted post content, topic titles, and usernames from categories they were never granted access to view. Because the attack requires no user interaction (UI:N) and uses standard network access, an attacker could automate this data exfiltration in minutes.