What is the CVSS score of CVE-2026-33428?

CVE-2026-33428 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Discourse are affected by CVE-2026-33428?

Organizations using Discourse should be aware of notable risk from CVE-2026-33428, a incorrect authorization vulnerability rated CVSS 6.5. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-33428?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Discourse CVE-2026-33428

MEDIUM

Incorrect Authorization (CWE-863)

2026-03-20 GitHub_M

Authentication Bypass Discourse

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 20, 2026 - 23:46 vuln.today

CVE Published

Mar 20, 2026 - 23:21 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a non-staff user with elevated group membership could access deleted posts belonging to any user due to an overly broad authorization check on the deleted posts index endpoint. Versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 contain a patch. No known workarounds are available.

AnalysisAI

An authorization bypass vulnerability exists in Discourse prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, where non-staff users with elevated group membership can access deleted posts belonging to any user through an overly permissive authorization check on the deleted posts index endpoint. This is a CWE-863 (Incorrect Authorization) vulnerability that allows unauthorized information disclosure of deleted content. No public exploit or active exploitation in the wild has been reported, but patches are available and no workarounds exist.

Technical ContextAI

Discourse is an open-source discussion platform (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*) that manages user roles, permissions, and content visibility through role-based access controls. The vulnerability stems from CWE-863 (Incorrect Authorization), which represents a failure to properly enforce authorization checks at the application layer. Specifically, the deleted posts index endpoint fails to adequately validate that the requesting user (non-staff with elevated group membership) has legitimate authorization to view deleted posts from other users. The authorization logic incorrectly trusts group membership as a sufficient condition for access, bypassing the intended restriction that deleted posts should only be viewable by staff members or the post author.

RemediationAI

Upgrade Discourse immediately to version 2026.3.0-latest.1, 2026.2.1, or 2026.1.2 or later, depending on your deployment branch, using the official patch provided in the vendor advisory at https://github.com/discourse/discourse/security/advisories/GHSA-frcw-p4mc-x6mp. No known workarounds are available, so patching is the only mitigation path. In the interim before patching, organizations should audit access logs to identify any non-staff users with elevated group memberships who may have accessed the deleted posts index, and consider temporarily restricting group elevation permissions or network access to the Discourse instance if operationally feasible.