Discourse CVE-2026-33514

The form templates feature must be explicitly enabled in the Discourse instance settings - this is not a default-on configuration in all deployments. At least one form template must be assigned to a category with restricted access (private category) for there to be any sensitive data to disclose. The attacker must hold a valid authenticated session (any trust level); the CVSS 4.0 vector PR:L confirms unauthenticated access is not possible. What limits exploitation: the SSVC assessment of automatable=no reflects that an attacker must first enumerate template IDs or category configurations, the sensitive data exposed is limited to template names and YAML field structures (not credentials, post content, or user data), and the feature must be both enabled and populated with restricted-category templates for the vulnerability to yield any meaningful disclosure. These conditions together substantially reduce the realistic attack surface beyond the raw score.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H reflects a network-reachable, low-privilege endpoint with high confidentiality impact on the vulnerable system, but AT:P (specific attack requirement) correctly signals that the form templates feature must be enabled and private templates must exist - conditions not met in all deployments. The vendor's own characterization of impact as 'site configuration metadata' disclosure conflicts with the VC:H metric: the exposed data comprises template names and YAML field structures, not credentials, PII, or post content, which in CVSS 3.1 terms maps more accurately to C:L. SSVC classifies exploitation as none and automatable as no, aligned with the EPSS score of 0.04% at the 12th percentile - both signal negligible real-world exploitation probability. No KEV listing exists and no POC has been identified. Overall, this is a low operational priority despite a moderate CVSS score: the authentication prerequisite, the feature-gate dependency, and the low sensitivity of exposed data collectively make this a theoretical concern for most organizations rather than an urgent remediation.

An authenticated Discourse user with only basic trust-level access sends a GET request to /form-templates.json, receiving a list that includes templates assigned to private categories they are not permitted to access. The user then fetches /form-templates/:id.json for any returned private template ID, obtaining the full YAML-structured field definitions. No POC is publicly available; exploitation requires only a valid session token and knowledge of the standard Discourse API endpoint.