What is the CVSS score of CVE-2026-33422?

CVE-2026-33422 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33422?

CVE-2026-33422 is a low-severity vulnerability in Discourse involving information exposure (CVSS 3.5).

How to fix or mitigate CVE-2026-33422?

During next maintenance window: Apply vendor patches when convenient. Verify information disclosure controls are in place.

Discourse CVE-2026-33422

LOW

Information Exposure (CWE-200)

2026-03-20 GitHub_M

Information Disclosure Discourse

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 23:04 nvd

LOW 3.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ip_address of a flagged user is exposed to any user who can access the review queue, including users who should not be able to see IP addresses. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain an information disclosure vulnerability where IP addresses of flagged users are exposed to any user with access to the review queue, including those without proper authorization. This allows unauthorized access to sensitive network information that should be restricted to administrators. The vulnerability has a CVSS score of 3.5 (low severity) with no known public exploits or KEV designation, but represents a clear privacy and data protection issue in moderation workflows.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a common class of information disclosure flaws where applications fail to implement proper access controls on sensitive data fields. Discourse, identified via CPE cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*, is an open-source discussion platform that uses a review queue system for moderating flagged user content. The underlying issue stems from insufficient authorization checks in the review queue interface, where the ip_address field is included in data served to users who have basic access to moderation tools but lack the administrative privileges required to view personally identifiable information such as IP addresses. This represents a classic privilege escalation flaw in the data exposure layer rather than a network or authentication bypass.

RemediationAI

Upgrade Discourse to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later immediately, depending on your current release branch. These patched versions implement proper authorization checks to restrict IP address visibility in the review queue to authorized administrators only. No official workarounds are available according to the advisory, so patching is the sole mitigation. Administrators should verify the patch deployment by confirming non-administrative moderators can no longer view IP addresses in the review queue interface. Consult the official Discourse security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-x32r-45vg-vm84 for detailed upgrade instructions specific to your deployment method.