CVE-2026-33300
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An authorization bypass in Discourse's Category Chatables controller allows moderators to get information about hidden groups and user counts.
Risk Assessment
Moderators can access data intended only for admins, compromising the confidentiality of group information.
Recommendation
Upgrade Discourse to version 2026.1.3, 2026.2.2, or 2026.3.0 depending on your release line.
Original NVD description (English source)
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, an authorization bypass in the Category Chatables Controller show action allowed moderators to get information on hidden groups names and user count. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.