Is there a patch available for CVE-2026-33514?

Yes, a patch is available for CVE-2026-33514. Update the affected software to the latest version immediately.

Discourse CVE-2026-33514

Q: What is the CVSS score of CVE-2026-33514?

CVE-2026-33514 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30821 MEDIUM

Missing Authorization (CWE-862)

2026-05-19 GitHub_M

Authentication Bypass Discourse

6.0

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible API requiring authenticated low-privilege access; confidentiality impact is low given only form template metadata (names and YAML structure) is disclosed, not credentials or sensitive user data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 23, 2026 - 17:57 vuln.today

Analysis Generated

Jul 23, 2026 - 17:57 vuln.today

Patch available

May 19, 2026 - 02:01 EUVD

CVE Published

May 19, 2026 - 00:59 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, an authenticated user on a Discourse instance with the form templates feature enabled can read the name and structured content of form templates that are intended exclusively for categories they are not authorized to access. Impact is limited to disclosure of site configuration metadata. This issue has been fixed in versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1.

AnalysisAI

Missing authorization in Discourse's FormTemplatesController exposes form template names and structured YAML content from restricted categories to any authenticated user, regardless of their category permissions. All active release tracks prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 are affected when the form templates feature is enabled. Impact is bounded to site configuration metadata disclosure - no post content, credentials, or user data are reachable - and no public exploit or CISA KEV listing exists, consistent with the EPSS score of 0.04% at the 12th percentile.

Technical ContextAI

Discourse is a Ruby on Rails-based open-source discussion platform (cpe:2.3:a:discourse:discourse:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization): the index and show actions in FormTemplatesController invoked FormTemplate.all and FormTemplate.find_by without filtering by the requesting user's category-level permissions. Discourse enforces category access through a guardian-based permission model via Category.secured(guardian), but this was never applied to form template queries. The fix introduces an accessible_form_templates scope that joins CategoryFormTemplate with Category.secured(guardian), returning only templates assigned to categories the user may access plus templates not yet assigned to any category. The commit diff at ae5c9570fb918442c4d96abc83c1e7e169909b02 confirms the corrected query logic and adds regression tests for both the list and show endpoints against private categories.

RemediationAI

Upgrade Discourse to version 2026.1.4, 2026.3.1, 2026.4.1, or 2026.5.0-latest.1 depending on the active release track, as documented in the GitHub Security Advisory at https://github.com/discourse/discourse/security/advisories/GHSA-w6g7-p2p9-2m5h and implemented in commit ae5c9570fb918442c4d96abc83c1e7e169909b02. If immediate patching is not feasible, disabling the form templates feature in Discourse site settings eliminates the attack surface entirely at the cost of losing form-based topic submission functionality. No other compensating control is known to preserve form template functionality while preventing unauthorized reads, since the flaw is in the data access layer of the API endpoint itself. Operators can also audit existing form templates to assess whether any contain sensitive configuration data that would warrant priority patching.