What is the CVSS score of CVE-2026-33425?

CVE-2026-33425 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Discourse are affected by CVE-2026-33425?

Organizations using Discourse should be aware of moderate risk from CVE-2026-33425 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-33425?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-33425

MEDIUM

Observable Discrepancy (CWE-203)

2026-03-20 GitHub_M

Information Disclosure Discourse

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:31 vuln.today

CVE Published

Mar 20, 2026 - 23:12 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a specific user is a member of a private group by observing changes in directory results when using the exclude_groups parameter. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. As a workaround, disable public access to the user directory via Admin → Settings → hide user profiles from public.

AnalysisAI

An information disclosure vulnerability in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 allows unauthenticated attackers to enumerate private group membership by observing directory result changes when manipulating the exclude_groups parameter. This enables attackers to determine whether specific users are members of private groups without authentication, representing a direct privacy violation. The vulnerability does not appear to be actively exploited in the wild (no KEV status indicated), but patches are available from the vendor.

Technical ContextAI

The vulnerability stems from CWE-203 (Observable Discrepancy), a classic information disclosure weakness where the application leaks sensitive data through observable behavioral differences. Discourse's user directory functionality, specifically the exclude_groups filtering parameter, fails to enforce proper access controls or sanitize response differences for unauthenticated requests. When an unauthenticated user queries the directory with exclude_groups parameters targeting private groups, the platform returns different result sets depending on group membership status, allowing an attacker to infer membership by comparing responses. The affected product is Discourse (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*), an open-source discussion platform written in Ruby on Rails that manages user directories and group memberships.

RemediationAI

Upgrade Discourse immediately to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later, depending on your release branch (see vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-r6rh-xvf5-r5f2). As an interim workaround if immediate patching is not feasible, disable public access to the user directory by navigating to Admin → Settings → hide user profiles from public. This prevents unauthenticated users from querying the directory entirely, eliminating the attack vector while patches are staged for deployment. Additionally, review group visibility settings and audit which groups are configured as private to minimize exposure.