What is the CVSS score of CVE-2026-33426?

CVE-2026-33426 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33426?

CVE-2026-33426 is a low-severity vulnerability in Discourse involving missing authorization (CVSS 3.5).

How to fix or mitigate CVE-2026-33426?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Discourse CVE-2026-33426

LOW

Missing Authorization (CWE-862)

2026-03-20 GitHub_M

Authentication Bypass Discourse

3.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.5 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:31 vuln.today

CVE Published

Mar 20, 2026 - 23:14 nvd

LOW 3.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and create synonyms for tags hidden in restricted tag groups, even if they lacked visibility into those tags. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

Discourse versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain an authorization bypass vulnerability where users with tag-editing permissions can edit and create tag synonyms for tags within restricted tag groups, even when those users lack visibility into the restricted tags themselves. This represents a broken access control issue (CWE-862) with low CVSS score (3.5) due to high privilege requirement and limited impact scope, though it enables unauthorized information disclosure and tag manipulation within the platform. No public exploit code or active exploitation in the wild has been reported at this time.

Technical ContextAI

The vulnerability exists within Discourse, an open-source discussion platform (CPE: cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) that manages user-generated content and community discussions. The root cause is classified under CWE-862 (Authorization Bypass Through User-Controlled Key), indicating insufficient permission checks in the tag synonym creation and editing logic. Specifically, the platform fails to properly validate whether a user with tag-editing permissions should be allowed to interact with tags belonging to restricted tag groups they cannot view. This suggests the permission model checks for tag-edit capability in isolation rather than enforcing contextual visibility controls, allowing privilege escalation at the tag-management layer without corresponding visibility controls.

RemediationAI

Upgrade Discourse immediately to version 2026.1.2, 2026.2.1, or 2026.3.0-latest.1 or later, depending on your current release branch. Refer to the GitHub security advisory at https://github.com/discourse/discourse/security/advisories/GHSA-2289-4m46-2hxh for specific upgrade instructions and compatibility notes. No workarounds are available according to the vendor advisory, making patching the only mitigation. In the interim, restrict tag-editing permissions to only trusted administrative users, and conduct an audit of tag synonym creation logs to identify any unauthorized changes made during the vulnerable period. Consider enabling audit logging if not already enabled to track all tag management operations.