Discourse CVE-2026-33427

Remote unauthenticated attacker can exploit Discourse versions before 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Victim interaction required: user must view the crafted authorization page displaying attacker-controlled domain, enabling social engineering attacks. No special configuration needed on default Discourse installations.

The real-world risk is moderate-to-high despite the absence of a CVSS vector. The attack vector is network-based and requires no authentication or user interaction beyond clicking a malicious link (low complexity), making it highly automatable and broadly scalable. EPSS data is unavailable, but the vulnerability's reliance on social engineering rather than technical exploitation means automated scanning will not detect active compromise; however, phishing campaigns leveraging this flaw could succeed at scale. The CWE-862 classification (Missing Authorization) indicates a fundamental control gap rather than a nuanced edge case. KEV inclusion status is unknown from the provided data, but the absence of known public exploits and the availability of patches in multiple release branches suggest this is pre-disclosure or early-stage. SSVC considerations favor high priority: exploitation is straightforward (user clicks crafted link), technical impact is significant (credential theft via social engineering), and automatable deployment of phishing campaigns is feasible. This should be treated as a high-priority patch despite lower CVSS-like scores.

An attacker crafts a phishing email containing a link to the victim's Discourse instance with a manipulated URL parameter that causes the authorization page to display the attacker's domain (e.g., 'discourse-login.attacker.com') instead of the legitimate Discourse domain. When the user clicks the link and sees the familiar Discourse UI combined with the attacker-controlled domain in the address bar or form fields, they are socially engineered into entering their credentials on the attacker's site. The attacker captures these credentials and gains unauthorized access to the victim's Discourse account, bypassing Discourse's actual authentication mechanisms.