Which versions of Discourse are affected by CVE-2026-33423?

CVE-2026-33423 is a low-severity vulnerability in Discourse involving missing authorization (CVSS 1.3).

How to fix or mitigate CVE-2026-33423?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Discourse CVE-2026-33423

Q: What is the CVSS score of CVE-2026-33423?

CVE-2026-33423 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Missing Authorization (CWE-862)

2026-03-20 GitHub_M

Authentication Bypass Discourse

1.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:16 vuln.today

CVE Published

Mar 20, 2026 - 23:06 nvd

LOW 1.3

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, staff can modify any user's group notification level. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

A privilege escalation vulnerability in Discourse allows staff members to arbitrarily modify group notification levels for any user without proper authorization checks. This affects Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, enabling authenticated staff users to alter notification settings for other users in ways they should not be permitted to do. While no CVSS score or EPSS data is available and no known public exploits have been confirmed, the vulnerability is classified under CWE-862 (Missing Authorization) and has been assigned a GitHub Security Advisory (GHSA-qggq-wr6h-vhrg) with patches available.

Technical ContextAI

Discourse is an open-source discussion and community platform built on Ruby on Rails. The vulnerability exists in the group notification level management subsystem, which should enforce role-based access control (RBAC) to ensure only authorized administrators can modify notification preferences for users and groups. The root cause is classified as CWE-862 (Missing Authorization), indicating that the application fails to perform proper authorization checks before allowing staff members to execute group notification modifications. This represents a common authorization bypass flaw where privilege checks are either missing or improperly implemented in the endpoint responsible for updating group notification levels. The affected product is identified via CPE as cpe:2.3:a:discourse:discourse, spanning multiple version lines (2026.1.x, 2026.2.x, and 2026.3.0-latest versions).

RemediationAI

Organizations running Discourse should immediately upgrade to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later depending on their current version line, as patches are available for all affected versions and no workarounds are documented. Administrators should consult the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-qggq-wr6h-vhrg for version-specific upgrade instructions and validation steps. Until patching is completed, restrict staff member access to group management features by auditing role assignments and enforcing principle of least privilege for administrative accounts. Additionally, review recent group notification level changes in audit logs to identify any unauthorized modifications that may have occurred while the system was vulnerable.