CVE-2026-33073: discourse-subscriptions plugin leaking stripe API key in multisite environment
Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0, the discourse-subscriptions plugin leaks stripe API keys across sites in a multisite cluster resulting in the potential for stripe related information to be leaked across sites within the same multisite cluster. This issue has been patched in versions 2026.1.3, 2026.2.2, and 2026.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
discourse-subscriptions pluginto a version that resolves this vulnerability.Fixed in 2026.1.3 - Upgrade
Upgrade
discourse-subscriptions pluginto a version that resolves this vulnerability.Fixed in 2026.2.2 - Upgrade
Upgrade
discourse-subscriptions pluginto a version that resolves this vulnerability.Fixed in 2026.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33073?
CVE-2026-33073 has a high severity level due to the potential leakage of sensitive Stripe API keys.
How do I fix CVE-2026-33073?
To mitigate CVE-2026-33073, update the discourse-subscriptions plugin to the latest version that addresses this vulnerability.
Which versions are affected by CVE-2026-33073?
CVE-2026-33073 affects Discourse versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and versions up to exclusive 2026.3.0.
What are the implications of CVE-2026-33073?
The implications of CVE-2026-33073 include unauthorized access to payment processing information due to leaked API keys.
Is CVE-2026-33073 specific to multitenancy setups?
Yes, CVE-2026-33073 specifically affects multisite environments where the discourse-subscriptions plugin is used.