What is the CVSS score of CVE-2026-33424?

CVE-2026-33424 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33424?

Organizations using Discourse should be aware of moderate risk from CVE-2026-33424, a incorrect authorization vulnerability rated CVSS 5.9. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-33424?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-33424

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-20 GitHub_M

Authentication Bypass Discourse

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:31 vuln.today

CVE Published

Mar 20, 2026 - 23:08 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an attacker can grant access to a private message topic through invites even after they lose access to that PM. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain an access control bypass vulnerability where attackers can grant invites to private message topics even after losing direct access to those conversations. This authentication bypass (CWE-863) allows unauthorized lateral privilege escalation within discussion communities. No public exploit code has been widely reported, but the vulnerability is patched across multiple release branches, indicating vendor awareness of active exploitation risk.

Technical ContextAI

The vulnerability resides in Discourse's private message (PM) invitation mechanism, which fails to properly validate whether the inviting user retains access to the target PM topic before processing invite requests. This represents a classic broken access control flaw (CWE-863: Incorrect Authorization) where authorization checks occur at insufficient privilege levels or are bypassed entirely. The affected product is Discourse (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*), an open-source discussion platform written in Ruby on Rails. The root cause involves inadequate re-authorization of the invitation action against current access state, allowing stale or revoked permissions to persist through the invite workflow. The attack surface is limited to authenticated users with prior PM access, but the authorization flaw allows this prior access to be weaponized indefinitely.

RemediationAI

Upgrade Discourse immediately to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 or any later release, depending on your current branch (see GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-hgcp-p7hq-cwxw). The vendor has provided patches across all three active release tracks and confirmed no workarounds are available, making patching the only mitigation. To minimize risk during the upgrade window, consider temporarily restricting PM access to administrative staff only via role-based permissions in Discourse settings, or audit recent PM invitations to identify any suspicious activity from previously-revoked users. Implement post-patch monitoring by reviewing PM access logs for invitations sent after the advisory publication date to detect potential pre-patch exploitation.