Discourse CVE-2026-33425

While a CVSS score was not provided, the attack vector is network-based and requires no authentication or user interaction, suggesting a low CVSS complexity score. The technical impact is limited to confidentiality (privacy of group membership), not integrity or availability. The lack of CVSS/EPSS data limits quantitative risk scoring, but qualitative assessment indicates moderate real-world risk: the vulnerability requires discovery of the exclude_groups parameter behavior and systematic enumeration, reducing opportunistic exploitation likelihood. However, if the user directory is publicly accessible, an attacker can perform reconnaissance at scale with minimal effort. The availability of patches for multiple release branches (2026.3.0, 2026.2.1, 2026.1.2) indicates vendor responsiveness and reduces remediation friction for most deployments.

An attacker discovers the Discourse installation's user directory is publicly accessible and programmatically iterates through a list of target user accounts, querying the directory API with exclude_groups parameters set to various private group identifiers. By observing whether result sets change when excluding specific groups, the attacker infers that users present in larger result sets are not members of the excluded group, while absent users are members. Within minutes, the attacker maps a complete membership roster for all private groups without authentication, enabling targeted social engineering or identifying organizational structure for a follow-up attack. A proof-of-concept would require basic HTTP request crafting against the /directory_items endpoint with manipulated exclude_groups parameters and response comparison logic.