Discourse CVE-2026-33422

The CVSS score of 3.5 reflects a low-severity classification with an attack vector of Network, low complexity, and requirement for low privileges (PR:L) but user interaction (UI:R). While the CVSS base score appears modest, the real-world risk is somewhat elevated by the nature of the exposed data: IP addresses are sensitive identifiers that can facilitate doxing, law enforcement targeting, or correlation with external breach databases. However, the low EPSS probability (not explicitly provided but implied by the low CVSS and lack of active exploitation) suggests this is not currently being weaponized. The absence of KEV designation and public POC indicates this is not a zero-day or actively exploited vulnerability in the wild. The attack requires an authenticated user with moderation privileges, which limits the threat surface. Using SSVC framework: exploitation status is unproven, the attack is not easily automatable due to user interaction requirements, and technical impact is limited to confidentiality. This should be prioritized as a medium remediation item rather than critical, but should not be deferred for Discourse deployments handling sensitive communities.

A community moderator with access to the review queue (granted to manage user flagging and content moderation) navigates to review flagged user posts and observes the IP address field is populated with the flagged user's network address. The moderator, lacking administrative privileges, should not have access to this information but can view it due to missing authorization controls. They could export or screenshot this data and correlate it with public IP geolocation databases or prior breaches to identify or target the flagged user offline. While the attack requires prior authentication and some user interaction to navigate the interface, the ease of data extraction (no additional clicks or techniques required) makes this a straightforward privacy violation that could affect any Discourse community with strict access control requirements.