CVE-2026-33073

MediumCVSS 5.3

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Discourse with the discourse-subscriptions plugin from versions 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 leaks Stripe API keys across sites in a multisite cluster, potentially exposing Stripe-related information across sites.

Risk Assessment

Leaked Stripe API keys could allow an attacker to access payment data and perform unauthorized transactions.

Recommendation

Update Discourse to versions 2026.1.3, 2026.2.2, or 2026.3.0 which contain the fix. Review cluster configuration for data isolation.

Original NVD description (English source)

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.