Discourse CVE-2026-33428

This vulnerability presents a moderate to high real-world risk despite the absence of CVSS/EPSS scoring data. The attack vector is network-based with low complexity (requires only valid authentication and group membership, not staff status), making it accessible to a broad class of authenticated users. The technical impact is limited to confidentiality breach (information disclosure of deleted posts) with no integrity or availability impact, suggesting lower severity than remote code execution vulnerabilities. The fact that patches exist in three concurrent release branches (2026.3.0-latest.1, 2026.2.1, 2026.1.2) indicates this was responsibly disclosed and fixed promptly. No public proof-of-concept or active exploitation has been documented. However, the ease of exploitation (any group-elevated non-staff user can trigger it) combined with the sensitive nature of deleted content (which may contain private or removed information) elevates practical risk. Organizations hosting Discourse should prioritize patching, but this is not an emergency-grade critical issue requiring immediate out-of-band response.

An authenticated non-staff user who has been granted elevated group membership (e.g., via a community moderator role that grants special privileges but not staff status) can directly access the deleted posts index endpoint and retrieve any deleted post from the platform, including those deleted by administrators or other users. The attacker would simply make a standard HTTP request to the vulnerable endpoint with their valid session credentials, requiring no special tools or complex attack chain. This could allow the attacker to recover sensitive information that was intentionally removed from public view.