Junglewise Threat Intelligence

CVE-2026-33415: Discourse improper access control in sentiment analytics endpoint

CVE-2026-33415 · Severity: low · CVSS 2.7 · Published 2026-03-31

Technologies: Discourse. Vendors: Discourse.

Executive brief

Discourse is an open-source platform used for hosting community discussion forums. A security flaw was found where moderators could view private discussion topics, post content, and usernames from restricted categories they were not supposed to access. This could lead to the exposure of sensitive or confidential community discussions to unauthorized staff members.

Technical details

An improper access control vulnerability (CWE-284) exists in the Discourse AI sentiment analytics endpoint. The 'sentiment posts' endpoint failed to properly filter results based on category permissions, allowing users with moderator-level privileges to bypass category boundaries. By querying this endpoint, an attacker can retrieve sensitive data including post content, topic titles, and usernames from restricted categories. The fix involves implementing a 'guardian.allowed_category_ids' filter in the SQL query within the sentiment controller. This issue is patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Affected products

  • Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0

Timeline

  • 2026-03-31: advisory: Vendor advisory published via GitHub (GHSA-vj5f-gg8m-93xg)
  • 2026-03-31: disclosed: CVE-2026-33415 published to NVD
  • 2026-03-31: patched: Fix committed to main repository

References

Related threats