CVE-2026-33074
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0 allow a user to purchase a lower tier subscription but gain benefits associated with a higher tier subscription.
Risk Assessment
Users may unfairly access premium features without proper payment, leading to financial loss and disruption of the platform's business model.
Recommendation
Update Discourse to versions 2026.1.3, 2026.2.2, or 2026.3.0 which contain the fix. Audit and correct any incorrect subscription assignments.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, a user may be able to purchase a lower tier subscription but grant themselves the benefits that comes along with a higher tier subscription. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.