Executive brief
Discourse is an open-source platform used for hosting community discussion forums. A security flaw was found where moderators could view private discussion topics, post content, and usernames from restricted categories they were not supposed to access. This could lead to the exposure of sensitive or confidential community discussions to unauthorized staff members.
Technical details
An improper access control vulnerability (CWE-284) exists in the Discourse AI sentiment analytics endpoint. The 'sentiment posts' endpoint failed to properly filter results based on category permissions, allowing users with moderator-level privileges to bypass category boundaries. By querying this endpoint, an attacker can retrieve sensitive data including post content, topic titles, and usernames from restricted categories. The fix involves implementing a 'guardian.allowed_category_ids' filter in the SQL query within the sentiment controller. This issue is patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected products
- Discourse Discourse 2026.1.0-latest to < 2026.1.3, 2026.2.0-latest to < 2026.2.2, 2026.3.0-latest to < 2026.3.0
Timeline
- 2026-03-31: advisory: Vendor advisory published via GitHub (GHSA-vj5f-gg8m-93xg)
- 2026-03-31: disclosed: CVE-2026-33415 published to NVD
- 2026-03-31: patched: Fix committed to main repository