Executive brief
Discourse is an open-source platform used for hosting online discussion forums and communities. A security flaw in its subscription plugin allows sensitive Stripe payment API keys to be shared across different sites hosted on the same server cluster. This could allow one site owner to access or interfere with the financial transaction data of another site within the same hosting environment.
Technical details
The vulnerability exists in the discourse-subscriptions plugin when running in a multisite configuration. The root cause is the use of a global state variable (::Stripe.api_key) to store the Stripe API key, which is mutated during requests. In multi-threaded environments, concurrent requests from different sites in the same cluster can lead to race conditions where one site's API key is used by another. This results in the exposure of sensitive Stripe-related information across site boundaries. The fix replaces the global mutation with a per-request configuration pattern using instance variables. Patches are available in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched